{"id":"CVE-2026-98723","kind":"vulnerability","aliases":["CVE-2026-98723"],"related":[],"title":"Linux kernel NVMe target: Preempt and Abort skips in-flight I/O","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: copy the hostid into the ctrl before creating PR pc_refs\n\nCommit 6202783184bf (\"nvmet: Improve nvmet_alloc_ctrl() interface and\nimplementation\") added a second uuid_copy() of args->hostid near the end\nof nvmet_alloc_ctrl(), and commit 7b658153f1b8 (\"nvmet: Remove duplicate\nuuid_copy\") removed the original copy that sat before\nnvmet_ctrl_init_pr() instead of the new one.\n\nSince then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the\nper-controller per-namespace reservation refs while the uuid_copy()\nfrom the connect data runs later, after the controller is published.\nThe ctrl is allocated with kzalloc(), so every pc_ref created on this\npath stores the nil UUID.\n\npc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort()\nmatches it against the preempted registrant's hostid to kill and drain\nthe victim's in-flight I/O for Preempt and Abort.  The match can never\nhit with the nil UUID, so whenever a namespace with reservations\nenabled exists before a host connects, which includes every reconnect,\nPreempt and Abort silently degrades into a plain Preempt: the\npreempting host sees success while the victim's in-flight I/O is still\nin the air.\n\nCopy the hostid where the rest of the connect data is consumed, before\nthe controller is published and before nvmet_ctrl_init_pr() takes its\nsnapshot.","summary":"The Linux kernel NVMe target stores a nil host UUID in reservation references, so the Preempt and Abort path never matches the victim host. The preempting host sees success while the victim's in-flight I/O keeps running.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","nvme-target","other","self-hosted"],"not_affected_if":["nvme-target-not-in-use"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:25+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:21+00:00","updated_at":"2026-10-25T05:17:21+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:17:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel NVMe target: Preempt and Abort skips in-flight I/O","impact":"low","summary":"The Linux kernel NVMe target stores a nil host UUID in reservation references, so the Preempt and Abort path never matches the victim host. The preempting host sees success while the victim's in-flight I/O keeps running.","category":"other","nicknames":[],"who_cares":["linux","kernel","nvme-target","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"victim's in-flight I/O not aborted during reservation preemption","analyst_note":"Check the kernel stable fix commit and the affected kernel version range at the NVD entry; the sources give no version list.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["nvme-target-not-in-use"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000553,"input_tokens":3759,"output_tokens":354,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98723':15A,18A '6202783184bf':90C '7b658153f1b8':116C 'abort':7A,45B,202C,225C,253C 'add':99C 'air':277C 'alloc':94C,112C,175C 'arg':105C 'commit':89C,115C 'connect':163C,246C,286C 'consum':196C,289C 'control':151C,169C,292C 'copi':78C,103C,121C,125C,160C,278C 'creat':85C,182C 'ctrl':83C,95C,113C,130C,141C,145C,173C,200C,298C 'cve':13A,16A 'data':164C,287C 'degrad':255C 'drain':214C 'duplic':119C 'enabl':241C 'end':109C 'everi':179C,249C 'exist':242C 'flight':11A,63B,220C,271C 'follow':72C 'hit':230C 'host':27B,36B,51B,54B,245C,262C 'hostid':80C,106C,146C,192C,210C,280C 'i/o':12A,64B,221C,272C 'implement':98C 'improv':92C 'in-flight':9A,61B,218C,269C 'includ':248C 'init':131C,142C,299C 'instead':133C 'interfac':96C 'keep':65B 'kernel':2A,19B,30B,70C 'kill':212C 'kzalloc':177C 'later':166C 'linux':1A,20B,29B,69C 'match':48B,203C,227C 'namespac':154C,238C 'near':107C 'never':47B,229C 'new':136C 'nil':35B,188C,233C 'nvme':3A,22B,31B 'nvme-target':21B 'nvmet':77C,91C,93C,111C,117C,129C,140C,197C,297C 'one':137C 'origin':124C 'path':46B,185C 'pc':87C,180C,190C 'per':150C,153C 'per-control':149C 'per-namespac':152C 'plain':258C 'pr':86C,132C,143C,198C,300C 'preempt':5A,43B,53B,207C,223C,251C,259C,261C 'publish':171C,294C 'reconnect':250C 'ref':88C,156C,181C,191C 'refer':40B 'registr':208C 'remov':118C,122C 'reserv':39B,155C,240C 'resolv':76C 'rest':283C 'run':66B,165C 'sat':127C 'second':101C 'see':55B,263C 'self':26B 'self-host':25B 'set':199C 'silent':254C 'sinc':138C 'singl':195C 'skip':8A 'snapshot':144C,303C 'still':274C 'store':33B,186C 'success':56B,264C 'take':301C 'target':4A,23B,32B 'uuid':37B,102C,120C,159C,189C,234C 'victim':50B,59B,216C,267C 'vulner':73C 'whenev':236C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98723","severity":null,"published_at":"2026-10-18T16:17:25+00:00","modified_at":"2026-10-19T10:19:36+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}