Answer in brief
CVE-2026-22998 records a High severity (CVSS 7.5) vulnerability in nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f775f2621c2ac5cc3a0b3a64665dad4fb146e510 <baabe43a0edefac8cd7b981ff87f967f6034dafe || >=4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d <76abc83a9d25593c2b7613c549413079c14a4686 || >=2871aa407007f6f531fae181ad252486e022df42 <7d75570002929d20e40110d6b03e46202c9d1bc7 || >=24e05760186dc070d3db190ca61efdbce23afc88 <fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4 || >=efa56305908ba20de2104f1b8508c6a7401833be <3def5243150716be86599c2a1767c29c68838b6d || >=efa56305908ba20de2104f1b8508c6a7401833be <374b095e265fa27465f34780e0eb162ff1bef913 || >=efa56305908ba20de2104f1b8508c6a7401833be <32b63acd78f577b332d976aa06b56e70d054cbba || ee5e7632e981673f42a50ade25e71e612e543d9d || 70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68 || >=5.10.209 <5.10.249 || >=5.15.148 <5.15.199 || >=6.1.75 <6.1.162 || >=6.6.14 <6.6.122 || >=5.4.268 <5.5 || >=6.7.2 <6.8 | baabe43a0edefac8cd7b981ff87f967f6034dafe, 76abc83a9d25593c2b7613c549413079c14a4686, 7d75570002929d20e40110d6b03e46202c9d1bc7, fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4, 3def5243150716be86599c2a1767c29c68838b6d, 374b095e265fa27465f34780e0eb162ff1bef913, 32b63acd78f577b332d976aa06b56e70d054cbba, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 5.5, 6.8 |
| Linux/Linuxgeneric | 6.8 | Not reported |
Published upstream
Jan 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 19, 2026
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate whether the command's data structures (cmd->req.sg and cmd->iov) have been properly initialized before processing H2C_DATA PDUs. The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command. Attack vectors that trigger NULL pointer dereferences: 1. H2C_DATA PDU sent before CONNECT → both pointers NULL 2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL 3. H2C_DATA PDU for uninitialized command slot → both pointers NULL The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because: - Uninitialized commands: both NULL - READ commands: cmd->req.sg allocated, cmd->iov NULL - WRITE commands: both allocated
Quoted source text, attributed separately from HOL analysis.