SB20261022329 - Improper initialization in Linux kernel nvme target driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper initialization (CVE-ID: CVE-2026-98723)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass persistent reservation abort enforcement and leave outstanding I/O active after reservation preemption.

The vulnerability exists due to incorrect initialization ordering in the Linux kernel NVMe target controller allocation path when creating per-controller reservation references before copying the host identifier into the controller. A remote user can submit I/O that remains active when another host successfully issues Preempt and Abort because the reservation references contain a nil UUID that prevents matching and aborting the preempted host's outstanding operations.

The issue occurs when a namespace with reservations enabled exists before the host connects, including on reconnection.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/23194531595c5d1d4454e3a607b0c8fc0c4e8695
• https://git.kernel.org/stable/c/5211fed41d7ec90e9ab7239dc4bffffe4d0b2b62
• https://git.kernel.org/stable/c/d3d6d7efdacc08616d23b3ac42272a494951dc0f