High 7.5Published Jan 25, 2026

CVE-2026-22998nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

Updated under an hour ago (Oct 27, 2026, 2:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate whether the command's data structures (cmd->req.sg and cmd->iov) have been properly initialized before processing H2C_DATA PDUs. The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command. Attack vectors that trigger NULL pointer dereferences: 1. H2C_DATA PDU sent before CONNECT → both pointers NULL 2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL 3. H2C_DATA PDU for uninitialized command slot → both pointers NULL The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because: - Uninitialized commands: both NULL - READ commands: cmd->req.sg allocated, cmd->iov NULL - WRITE commands: both allocated

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f775f2621c2ac5cc3a0b3a64665dad4fb146e510 before baabe43a0edefac8cd7b981ff87f967f6034dafe; from 4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d before 76abc83a9d25593c2b7613c549413079c14a4686; 2871aa407007f6f531fae181ad252486e022df42 builds before 7d75570002929d20e40110d6b03e46202c9d1bc7; from 24e05760186dc070d3db190ca61efdbce23afc88 before fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4; from efa56305908ba20de2104f1b8508c6a7401833be before 3def5243150716be86599c2a1767c29c68838b6d; from efa56305908ba20de2104f1b8508c6a7401833be before 374b095e265fa27465f34780e0eb162ff1bef913; from efa56305908ba20de2104f1b8508c6a7401833be before 32b63acd78f577b332d976aa06b56e70d054cbba; ee5e7632e981673f42a50ade25e71e612e543d9d; and 7 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.4.268 before 5.5; from 5.10.209 before 5.10.249; from 5.15.148 before 5.15.199; from 6.1.75 before 6.1.162; from 6.6.14 before 6.6.122; from 6.7.2 before 6.12.67; from 6.13 before 6.18.7; 6.19; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/baabe43a0edefac8cd7b981ff87f967f6034dafe	patch
https://git.kernel.org/stable/c/76abc83a9d25593c2b7613c549413079c14a4686	patch
https://git.kernel.org/stable/c/7d75570002929d20e40110d6b03e46202c9d1bc7	patch
https://git.kernel.org/stable/c/fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4	patch
https://git.kernel.org/stable/c/3def5243150716be86599c2a1767c29c68838b6d	patch
https://git.kernel.org/stable/c/374b095e265fa27465f34780e0eb162ff1bef913	patch
https://git.kernel.org/stable/c/32b63acd78f577b332d976aa06b56e70d054cbba	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.