CVE-2026-98964

nvmet: use the local P2P device on metadata allocation failure

State: Published
Severity: 7.5 High
Published: Oct 23, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: use the local P2P device on metadata allocation failure

nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails, out_free_sg passes req->p2p_dev to pci_p2pmem_free_sgl() before that assignment has taken place.

Pass the local p2p_dev argument instead, so cleanup uses the same PCI device as the successful data allocation.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c440cd080761b18a52cac20f2a42e5da1e3995af to before eb72e2eeff559eb1eb07b1d644ce2bc1a16c4a80Affected bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before 48c8b59429d09a7c3598de425acbc2d3f4e6647bAffected bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before e8f24ae4f45efe6861f801c6ebd2789c9016f1bcAffected bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before 3c231142c4f4bb96836469eb276026ec55940093Affected bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before 32f21607911a1f69c8f0f93a6c28fe6f8490aa98Affected bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before ce79a6c5cc1b8054ec8d3eba16adda4a36113438Affected bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before 73bf0f9579633b531098a475e6e55c9316763aedAffected bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before 4aa9c0f377a4de5e8fddce76b34ee4529639a1ffAffected 8a452d62e7cea3c8a2676a3b89a9118755a1a271Affected 5.10.43 to before 5.10.273Affected 5.12.10 to before 5.13Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.11 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

c440cd080761b18a52cac20f2a42e5da1e3995af to before eb72e2eeff559eb1eb07b1d644ce2bc1a16c4a80Affected
bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before 48c8b59429d09a7c3598de425acbc2d3f4e6647bAffected
bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before e8f24ae4f45efe6861f801c6ebd2789c9016f1bcAffected
bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before 3c231142c4f4bb96836469eb276026ec55940093Affected
bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before 32f21607911a1f69c8f0f93a6c28fe6f8490aa98Affected
bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before ce79a6c5cc1b8054ec8d3eba16adda4a36113438Affected
bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before 73bf0f9579633b531098a475e6e55c9316763aedAffected
bcd9a0797d73eeff659582f23277e7ab6e5f18f3 to before 4aa9c0f377a4de5e8fddce76b34ee4529639a1ffAffected
8a452d62e7cea3c8a2676a3b89a9118755a1a271Affected
5.10.43 to before 5.10.273Affected
5.12.10 to before 5.13Affected

LinuxLinux

5.13Affected
before 5.13Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.11 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.