CVE-2026-22998High· 7.5▾ Twilight

nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") ad…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jan 25, 2026

Updated

Oct 19, 2026

CVSS

7.5

Vendor

Linux

Product

Linux

CWE

—

Depth score

41 · Moderate

EPSS

0.79% · p55

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

decided 2026-06-16

Exploitation: none
Automatable: yes
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 267 days

Jan 25, 2026Published
Disclosed via CVEORG
Oct 19, 2026Record revised
Last analysed / modified upstream
Oct 19, 2026EPSS first tracked
0.8%

Linux #cve.org

Affected

Linux >= f775f2621c2ac5cc3a0b3a64665dad4fb146e510 < baabe43a0edefac8cd7b981ff87f967f6034dafe
Linux >= 4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d < 76abc83a9d25593c2b7613c549413079c14a4686
Linux >= 2871aa407007f6f531fae181ad252486e022df42 < 7d75570002929d20e40110d6b03e46202c9d1bc7
Linux >= 24e05760186dc070d3db190ca61efdbce23afc88 < fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4
Linux >= efa56305908ba20de2104f1b8508c6a7401833be < 3def5243150716be86599c2a1767c29c68838b6d
Linux >= efa56305908ba20de2104f1b8508c6a7401833be < 374b095e265fa27465f34780e0eb162ff1bef913
Linux >= efa56305908ba20de2104f1b8508c6a7401833be < 32b63acd78f577b332d976aa06b56e70d054cbba
Linux ee5e7632e981673f42a50ade25e71e612e543d9d
Linux 70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68
Linux >= 5.10.209 < 5.10.249
Linux >= 5.15.148 < 5.15.199
Linux >= 6.1.75 < 6.1.162
Linux >= 6.6.14 < 6.6.122
Linux >= 5.4.268 < 5.5
Linux >= 6.7.2 < 6.8
Linux 6.8

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate whether the command's data structures (cmd->req.sg and cmd->iov) have been properly initialized before processing H2C_DATA PDUs.

The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command.

Attack vectors that trigger NULL pointer dereferences:

H2C_DATA PDU sent before CONNECT → both pointers NULL
H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL
H2C_DATA PDU for uninitialized command slot → both pointers NULL

The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because:

Uninitialized commands: both NULL
READ commands: cmd->req.sg allocated, cmd->iov NULL
WRITE commands: both allocated

Affected

Linux >= f775f2621c2ac5cc3a0b3a64665dad4fb146e510 < baabe43a0edefac8cd7b981ff87f967f6034dafe
Linux >= 4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d < 76abc83a9d25593c2b7613c549413079c14a4686
Linux >= 2871aa407007f6f531fae181ad252486e022df42 < 7d75570002929d20e40110d6b03e46202c9d1bc7
Linux >= 24e05760186dc070d3db190ca61efdbce23afc88 < fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4
Linux >= efa56305908ba20de2104f1b8508c6a7401833be < 3def5243150716be86599c2a1767c29c68838b6d
Linux >= efa56305908ba20de2104f1b8508c6a7401833be < 374b095e265fa27465f34780e0eb162ff1bef913
Linux >= efa56305908ba20de2104f1b8508c6a7401833be < 32b63acd78f577b332d976aa06b56e70d054cbba
Linux ee5e7632e981673f42a50ade25e71e612e543d9d
Linux 70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68
Linux >= 5.10.209 < 5.10.249
Linux >= 5.15.148 < 5.15.199
Linux >= 6.1.75 < 6.1.162
Linux >= 6.6.14 < 6.6.122
Linux >= 5.4.268 < 5.5
Linux >= 6.7.2 < 6.8
Linux 6.8

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.2 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

Attack vectors that trigger NULL pointer dereferences:

H2C_DATA PDU sent before CONNECT → both pointers NULL

H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL

H2C_DATA PDU for uninitialized command slot → both pointers NULL

The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because:

Uninitialized commands: both NULL

READ commands: cmd->req.sg allocated, cmd->iov NULL

WRITE commands: both allocated

Affected

Linux >= f775f2621c2ac5cc3a0b3a64665dad4fb146e510 < baabe43a0edefac8cd7b981ff87f967f6034dafe

Linux >= 4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d < 76abc83a9d25593c2b7613c549413079c14a4686

Linux >= 2871aa407007f6f531fae181ad252486e022df42 < 7d75570002929d20e40110d6b03e46202c9d1bc7

Linux >= 24e05760186dc070d3db190ca61efdbce23afc88 < fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4

Linux >= efa56305908ba20de2104f1b8508c6a7401833be < 3def5243150716be86599c2a1767c29c68838b6d

Linux >= efa56305908ba20de2104f1b8508c6a7401833be < 374b095e265fa27465f34780e0eb162ff1bef913

Linux >= efa56305908ba20de2104f1b8508c6a7401833be < 32b63acd78f577b332d976aa06b56e70d054cbba

Linux ee5e7632e981673f42a50ade25e71e612e543d9d

Linux 70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68

Linux >= 5.10.209 < 5.10.249

Linux >= 5.15.148 < 5.15.199

Linux >= 6.1.75 < 6.1.162

Linux >= 6.6.14 < 6.6.122

Linux >= 5.4.268 < 5.5

Linux >= 6.7.2 < 6.8

Linux 6.8