CVE-2026-98723 nvmet: copy the hostid into the ctrl before creating PR pc_refs
A logic error in Linux kernel NVMe target allows hosts to bypass reservation abort mechanisms, leaving victim I/O active during preemption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98723?
CVE-2026-98723 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet: copy the hostid into the ctrl before creating PR pc_refs
Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and implementation") added a second uuid_copy() of args->hostid near the end of nvmet_alloc_ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate uuid_copy") removed the original copy that sat before nvmet_ctrl_init_pr() instead of the new one.
Since then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the per-controller per-namespace reservation refs while the uuid_copy() from the connect data runs later, after the controller is published. The ctrl is allocated with kzalloc(), so every pc_ref created on this path stores the nil UUID.
pc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort() matches it against the preempted registrant's hostid to kill and drain the victim's in-flight I/O for Preempt and Abort. The match can never hit with the nil UUID, so whenever a namespace with reservations enabled exists before a host connects, which includes every reconnect, Preempt and Abort silently degrades into a plain Preempt: the preempting host sees success while the victim's in-flight I/O is still in the air.
Copy the hostid where the rest of the connect data is consumed, before the controller is published and before nvmet_ctrl_init_pr() takes its snapshot.
Which versions are affected by CVE-2026-98723?
How do I fix CVE-2026-98723?
Apply the vendor's patch.
Is CVE-2026-98723 being exploited?
There is no known exploitation of CVE-2026-98723 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98723, DEBIAN-CVE-2026-98723, GHSA-hpxm-6496-49xp, UBUNTU-CVE-2026-98723.