{"id":"CVE-2026-98964","kind":"vulnerability","aliases":["CVE-2026-98964"],"related":[],"title":"Linux kernel: NVMe target P2P metadata allocation failure frees wrong device","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: use the local P2P device on metadata allocation failure\n\nnvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data\nand metadata SGL allocations succeed. If the data allocation succeeds\nbut the metadata allocation fails, out_free_sg passes req->p2p_dev to\npci_p2pmem_free_sgl() before that assignment has taken place.\n\nPass the local p2p_dev argument instead, so cleanup uses the same PCI\ndevice as the successful data allocation.","summary":"In the Linux NVMe target driver (nvmet), a failed metadata allocation after a successful data allocation frees peer-to-peer memory using a device pointer that has not yet been set. The sources describe a cleanup-path bug and do not state an attacker-controlled impact.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","nvme-target","self-hosted"],"not_affected_if":["no-nvmet-target","no-p2pdma"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing nvmet_req_alloc_p2pmem_sgls cleanup (the sources do not name a version)","status":"open","published_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:43+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:57:43Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing nvmet_req_alloc_p2pmem_sgls cleanup (the sources do not name a version)","reach":"unknown","title":"Linux kernel: NVMe target P2P metadata allocation failure frees wrong device","impact":"low","summary":"In the Linux NVMe target driver (nvmet), a failed metadata allocation after a successful data allocation frees peer-to-peer memory using a device pointer that has not yet been set. The sources describe a cleanup-path bug and do not state an attacker-controlled impact.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","nvme-target","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources describe only a cleanup-path device mismatch","analyst_note":"Check the NVD entry and the linked upstream kernel commit for the affected version range and any stated security impact.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-nvmet-target","no-p2pdma"],"who_is_affected":"Systems running a Linux kernel with the NVMe target (nvmet) and peer-to-peer DMA (P2PDMA) memory in use, such as NVMe-oF targets that use P2P memory for metadata-bearing I/O. Hosts that do not run the NVMe target or do not use P2P memory are unlikely to be affected. The sources do not state further exposure details.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000621,"input_tokens":3412,"output_tokens":559,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98964':14A,17A 'alloc':7A,38B,43B,95C,99C,113C,118C,123C,161C 'argument':148C 'assign':102C,139C 'attack':74B 'attacker-control':73B 'bug':67B 'cleanup':65B,151C 'cleanup-path':64B 'control':75B 'cve':12A,15A 'data':42B,109C,117C,160C 'describ':62B 'dev':105C,131C,147C 'devic':11A,52B,92C,156C 'driver':33B 'fail':36B,124C 'failur':8A,96C 'follow':82C 'free':9A,44B,126C,135C 'host':27B 'impact':76B 'infrastructur':18B 'instead':149C 'kernel':2A,21B,80C 'linux':1A,20B,30B,79C 'linux-kernel':19B 'local':90C,145C 'memori':49B 'metadata':6A,37B,94C,111C,122C 'nvme':3A,23B,31B 'nvme-target':22B 'nvmet':34B,87C,97C 'p2p':5A,91C,104C,130C,146C 'p2pmem':100C,134C 'pass':128C,143C 'path':66B 'pci':133C,155C 'peer':46B,48B 'peer-to-p':45B 'place':142C 'pointer':53B 'req':98C,103C,129C 'resolv':86C 'self':26B 'self-host':25B 'set':59B 'sg':127C 'sgl':112C,136C 'sgls':101C 'sourc':61B 'state':71B 'succeed':114C,119C 'success':41B,159C 'taken':141C 'target':4A,24B,32B 'use':50B,88C,152C 'vulner':83C 'wrong':10A 'yet':57B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the NVMe target (nvmet) and peer-to-peer DMA (P2PDMA) memory in use, such as NVMe-oF targets that use P2P memory for metadata-bearing I/O. Hosts that do not run the NVMe target or do not use P2P memory are unlikely to be affected. The sources do not state further exposure details.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98964","severity":null,"published_at":"2026-10-23T13:17:17+00:00","modified_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98964","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98964","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}