Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-22998— nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于空指针取消引用，可能导致内核崩溃。

CVSS 7.5 · High EPSS 0.79% · P56

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 24

VendorProduct Version RangeStatus
Linux Linux f775f2621c2ac5cc3a0b3a64665dad4fb146e510< baabe43a0edefac8cd7b981ff87f967f6034dafe affected
4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d< 76abc83a9d25593c2b7613c549413079c14a4686 affected
2871aa407007f6f531fae181ad252486e022df42< 7d75570002929d20e40110d6b03e46202c9d1bc7 affected
24e05760186dc070d3db190ca61efdbce23afc88< fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4 affected
efa56305908ba20de2104f1b8508c6a7401833be< 3def5243150716be86599c2a1767c29c68838b6d affected
efa56305908ba20de2104f1b8508c6a7401833be< 374b095e265fa27465f34780e0eb162ff1bef913 affected
efa56305908ba20de2104f1b8508c6a7401833be< 32b63acd78f577b332d976aa06b56e70d054cbba affected
ee5e7632e981673f42a50ade25e71e612e543d9d affected
… +16 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-22998

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate whether the command's data structures (cmd->req.sg and cmd->iov) have been properly initialized before processing H2C_DATA PDUs. The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command. Attack vectors that trigger NULL pointer dereferences: 1. H2C_DATA PDU sent before CONNECT → both pointers NULL 2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL 3. H2C_DATA PDU for uninitialized command slot → both pointers NULL The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because: - Uninitialized commands: both NULL - READ commands: cmd->req.sg allocated, cmd->iov NULL - WRITE commands: both allocated
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于空指针取消引用，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux f775f2621c2ac5cc3a0b3a64665dad4fb146e510 ~ baabe43a0edefac8cd7b981ff87f967f6034dafe -
Linux Linux 6.8 -

II. Public POCs for CVE-2026-22998

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-22998

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-01-25 · 20 CVEs total

CVE-2026-23004 7.8 HIGH dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
CVE-2025-71162 7.8 HIGH dmaengine: tegra-adma: Fix use-after-free
CVE-2026-22999 7.8 HIGH net/sched: sch_qfq: do not free existing class in qfq_change_class()
CVE-2026-23001 7.8 HIGH macvlan: fix possible UAF in macvlan_forward_source()
CVE-2026-23010 7.8 HIGH ipv6: Fix use-after-free in inet6_addr_del().
CVE-2026-23003 7.5 HIGH ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
CVE-2026-22997 7.5 HIGH net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the
CVE-2026-23013 7.0 HIGH net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback
CVE-2026-23009 xhci: sideband: don't dereference freed ring when removing sideband endpoint
CVE-2026-23008 drm/vmwgfx: Fix KMS with 3D on HW version 10
CVE-2026-23007 block: zero non-PI portion of auto integrity buffer
CVE-2026-23006 ASoC: tlv320adcx140: fix null pointer
CVE-2026-23005 x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
CVE-2026-23002 lib/buildid: use __kernel_read() for sleepable context
CVE-2026-23000 net/mlx5e: Fix crash on profile change rollback failure
CVE-2026-23011 ipv4: ip_gre: make ipgre_header() robust
CVE-2026-22996 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
CVE-2025-71163 dmaengine: idxd: fix device leaks on compat bind and unbind
CVE-2026-23012 mm/damon/core: remove call_control in inactive contexts

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-22998

No comments yet

Leave a comment