HIGH Introduced in 6.14
nvmet SGL OOB
CVE-2026-98724
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr_descs zero, so nvmet_pci_epf_get_sgl_segment() reads the type byte of sgls[-1] outside the allocated buffer. If that byte contains a segment descriptor type, the function also copies the preceding 16 bytes and returns a negative descriptor count. The read was reproduced in 3/3 KASAN boots with only the host transfer mocked by a KUnit test: BUG: KASAN: slab-out-of-bounds in nvmet_pci_epf_get_sgl_segment Read of size 1 by task kunit_try_catch Call Trace: nvmet_pci_epf_get_sgl_segment nvmet_pci_epf_short_sgl_test Kernel panic - not syncing: KASAN: panic_on_warn set ... Reject segments that cannot hold one descriptor before allocating or transferring their contents.
02KernelScan AI Analysis
Risk summary
Systems acting as NVMe targets using the PCI endpoint function driver are at risk. An adjacent NVMe host can trigger a kernel panic (denial of service) and potentially leak small amounts of kernel heap memory by sending a crafted NVMe command with an undersized SGL segment. The attack requires physical or logical access to the PCIe link connecting the host to the target.
Vulnerability analysis
The NVMe PCI endpoint function target driver does not validate the length of host-provided scatter-gather list (SGL) segments before processing them. A malicious NVMe host can send a command with an SGL segment length that is nonzero but smaller than a single descriptor, causing the driver to compute a descriptor count of zero and then read memory immediately preceding the allocated buffer. If the byte read happens to match a segment descriptor type, the driver also copies the preceding 16 bytes of kernel heap memory, potentially leaking sensitive data, and returns a negative descriptor count that triggers a kernel panic. The fix adds a length check to reject any segment too short to hold one descriptor before allocation occurs. This vulnerability is reachable by any host connected to the PCIe endpoint — typically an adjacent system via direct PCIe attachment or a PCIe switch — and requires no privileges on the target system.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.14 | 6.18.56 | 2423a05dd0f2 |
| 7.2 | 6.14 | 7.2.10 | 472df1d103db |
| mainline | 6.14 | 7.3 | 5d5fbfbbacd1 |