Live › vulnerability › CVE-2026-98964
Go to dashboardIn the Linux NVMe target driver (nvmet), a failed metadata allocation after a successful data allocation frees peer-to-peer memory using a device pointer that has not yet been set. The sources describe a cleanup-path bug and do not state an attacker-controlled impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the NVMe target (nvmet) and peer-to-peer DMA (P2PDMA) memory in use, such as NVMe-oF targets that use P2P memory for metadata-bearing I/O. Hosts that do not run the NVMe target or do not use P2P memory are unlikely to be affected. The sources do not state further exposure details.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
nvmet: use the local P2P device on metadata allocation failure
nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails, out_free_sg passes req->p2p_dev to pci_p2pmem_free_sgl() before that assignment has taken place.
Pass the local p2p_dev argument instead, so cleanup uses the same PCI device as the successful data allocation.
This page as .md · .json · in your agent: get_signal("CVE-2026-98964")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.