{"id":"CVE-2026-98964","revision":"5f93a687d3f249baae8994783986d008","records":[{"revision":"5f93a687d3f249baae8994783986d008","observedAt":"2026-10-24T16:17:04.479+00:00","statement":{"source":"cve-program","id":"CVE-2026-98964","aliases":[],"title":"nvmet: use the local P2P device on metadata allocation failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: use the local P2P device on metadata allocation failure\n\nnvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data\nand metadata SGL allocations succeed. If the data allocation succeeds\nbut the metadata allocation fails, out_free_sg passes req->p2p_dev to\npci_p2pmem_free_sgl() before that assignment has taken place.\n\nPass the local p2p_dev argument instead, so cleanup uses the same PCI\ndevice as the successful data allocation.","state":0,"publishedAt":"2026-10-23T12:19:32.374+00:00","modifiedAt":"2026-10-24T14:09:40.85+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/nvme/target/core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"bcd9a0797d73eeff659582f23277e7ab6e5f18f3\",\n                            \"lessThan\": \"3c231142c4f4bb96836469eb276026ec55940093\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bcd9a0797d73eeff659582f23277e7ab6e5f18f3\",\n                            \"lessThan\": \"32f21607911a1f69c8f0f93a6c28fe6f8490aa98\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bcd9a0797d73eeff659582f23277e7ab6e5f18f3\",\n                            \"lessThan\": \"ce79a6c5cc1b8054ec8d3eba16adda4a36113438\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bcd9a0797d73eeff659582f23277e7ab6e5f18f3\",\n                            \"lessThan\": \"73bf0f9579633b531098a475e6e55c9316763aed\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bcd9a0797d73eeff659582f23277e7ab6e5f18f3\",\n                            \"lessThan\": \"4aa9c0f377a4de5e8fddce76b34ee4529639a1ff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c440cd080761b18a52cac20f2a42e5da1e3995af\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8a452d62e7cea3c8a2676a3b89a9118755a1a271\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.43\",\n                            \"lessThan\": \"5.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.12.10\",\n                            \"lessThan\": \"5.13\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/nvme/target/core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.113\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.11\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/3c231142c4f4bb96836469eb276026ec55940093","https://git.kernel.org/stable/c/32f21607911a1f69c8f0f93a6c28fe6f8490aa98","https://git.kernel.org/stable/c/ce79a6c5cc1b8054ec8d3eba16adda4a36113438","https://git.kernel.org/stable/c/73bf0f9579633b531098a475e6e55c9316763aed","https://git.kernel.org/stable/c/4aa9c0f377a4de5e8fddce76b34ee4529639a1ff"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98964","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98964","identifiers":["CVE-2026-98964"]},"retained":false,"historicalAffected":[]}],"coverage":[]}