In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's… (CVE-2026-98724)

The Linux kernel's nvmet pci-epf driver had a vulnerability where the host controls the length of an SGL segment. If the length is nonzero but smaller than the size of one SGL descriptor, the function nvmet_pci_epf_get_sgl_segment() calculates zero descriptors and reads the type byte from memory before the allocated buffer (sgls[-1]). If this byte appears as a segment descriptor type, the function copies preceding bytes and returns a negative descriptor count, causing an out-of-bounds read. This flaw was reproducible with KASAN tests, triggering kernel panic. The vulnerability was resolved by rejecting segments that cannot hold at least one descriptor before allocation or data transfer.

The vulnerability leads to an out-of-bounds read in kernel memory, which can cause kernel panic and system instability. While no direct code execution or privilege escalation is described, the kernel panic can result in denial of service conditions. There is no evidence of exploitation in the wild.

A fix is available that rejects SGL segments too short to hold a descriptor before processing. Users should update their Linux kernel to a version that includes this fix. Since no vendor advisory or patch link is provided, check the official Linux kernel repositories or vendor advisories for the patch and apply it promptly.