In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc_refs Commit… (CVE-2026-98723)

The Linux kernel nvmet vulnerability (CVE-2026-98723) stems from a logic error in the handling of the hostid within the nvmet_alloc_ctrl() function. A commit changed the timing of uuid_copy() calls, resulting in the controller's hostid being nil when nvmet_ctrl_init_pr() snapshots it into per-controller per-namespace reservation references. Since pc_ref->hostid is used to match preempted registrants for aborting in-flight I/O, the nil UUID prevents correct matching. This causes Preempt and Abort operations to degrade silently into Preempt only, allowing victim I/O to remain unhandled during reconnects. The resolution is to copy the hostid earlier, before the controller is published and before the reservation snapshot is taken.

The vulnerability causes the Preempt and Abort mechanism in the nvmet subsystem to fail to properly abort victim in-flight I/O during reconnects when persistent reservations are enabled. This silent degradation means that the preempting host believes the abort succeeded while the victim's I/O continues, potentially leading to inconsistent I/O states or data integrity issues in environments relying on these reservation features.

A fix has been implemented in the Linux kernel source code to copy the hostid earlier in the connection process, ensuring correct matching for Preempt and Abort operations. Users should update to a kernel version that includes this fix. Patch status is not explicitly stated in the provided data; therefore, check the official Linux kernel advisories or vendor patches for the exact fixed versions and remediation guidance.