HIGH Introduced in 6.15
nvmet HostId Bypass
CVE-2026-98723
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
01Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc_refs Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and implementation") added a second uuid_copy() of args->hostid near the end of nvmet_alloc_ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate uuid_copy") removed the original copy that sat before nvmet_ctrl_init_pr() instead of the new one. Since then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the per-controller per-namespace reservation refs while the uuid_copy() from the connect data runs later, after the controller is published. The ctrl is allocated with kzalloc(), so every pc_ref created on this path stores the nil UUID. pc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort() matches it against the preempted registrant's hostid to kill and drain the victim's in-flight I/O for Preempt and Abort. The match can never hit with the nil UUID, so whenever a namespace with reservations enabled exists before a host connects, which includes every reconnect, Preempt and Abort silently degrades into a plain Preempt: the preempting host sees success while the victim's in-flight I/O is still in the air. Copy the hostid where the rest of the connect data is consumed, before the controller is published and before nvmet_ctrl_init_pr() takes its snapshot.
02KernelScan AI Analysis
Risk summary
NVMe-oF targets using persistent reservations on namespaces before a host connects — including all reconnect scenarios — will silently degrade Preempt and Abort operations to plain Preempt. The victim host's in-flight I/O is not killed or drained, allowing concurrent writes to shared storage that can corrupt data. Any deployment exposing an NVMe/TCP, NVMe/RDMA, or NVMe/FC target with persistent reservations enabled is affected.
Vulnerability analysis
When an NVMe host connects to a target, the target records the host's identifier before setting up persistent reservation tracking for that connection. Due to a code change, this identifier was being recorded too late — after the reservation subsystem had already captured a default zero value. As a result, the reservation system stores an empty identifier for the host. When a Preempt and Abort command later arrives to remove a conflicting reservation, the target cannot match the stored empty identifier against the actual host, so it skips the abort step that would stop the victim's in-flight I/O. The fix ensures the host identifier is recorded before the reservation subsystem reads it. Any NVMe-over-Fabrics target with persistent reservations enabled on a namespace before a host connects — including all reconnection scenarios — is affected.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.15 | 6.18.56 | d3d6d7efdacc |
| 7.2 | 6.15 | 7.2.10 | 23194531595c |
| mainline | 6.15 | 7.3 | 5211fed41d7e |