CVE-2026-22998: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22998 is a NULL pointer dereference vulnerability in the Linux kernel's NVMe-TCP (nvmet-tcp) subsystem, specifically in the nvmet_tcp_build_pdu_iovec() function. It was disclosed on January 25, 2026, and affects multiple Linux kernel stable branches including 5.4.268–5.4.x (before 5.5), 5.10.209–5.10.x (before 5.10.249), 5.15.148–5.15.x (before 5.15.199), 6.1.75–6.1.x (before 6.1.162), 6.6.14–6.6.x (before 6.6.122), 6.7.2–6.12.x (before 6.12.67), and 6.13–6.18.x (before 6.18.7), as well as 6.19-rc1 through rc5. Microsoft's Azure Linux (AZL3 kernel 6.6.121.1-1 and CBL2 kernel 5.15.186.1-1) is also affected. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) introduced by an incomplete fix in commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length"), which added bounds checking in nvmet_tcp_handle_h2c_data_pdu() but failed to validate whether cmd->req.sg and cmd->iov are properly initialized before processing H2C_DATA PDUs. The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks, making it exploitable via three attack vectors: (1) sending an H2C_DATA PDU before a CONNECT command (both pointers NULL), (2) sending an H2C_DATA PDU for a READ command (cmd->req.sg allocated, cmd->iov NULL), and (3) sending an H2C_DATA PDU for an uninitialized command slot (both NULL). The attack requires only network access immediately after the ICREQ/ICRESP handshake, with no authentication or prior command required (Red Hat Bugzilla).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel crash or system hang — a complete denial of service for the affected host. The vulnerability has no confidentiality or integrity impact; the sole consequence is availability loss (CVSS A:H, C:N, I:N). Systems acting as NVMe-TCP targets (nvmet-tcp) are at risk; any network-accessible NVMe-TCP endpoint running a vulnerable kernel version can be crashed by an unauthenticated remote attacker without any user interaction (Red Hat Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify hosts exposing NVMe-TCP target ports (default TCP port 4420 or 8009) using network scanners such as Nmap (nmap -p 4420,8009 <target>) or Shodan queries for NVMe-TCP services running vulnerable kernel versions.
2. Establish TCP connection: Connect to the NVMe-TCP target port and complete the ICREQ/ICRESP handshake (the initial connection establishment exchange required by the NVMe-TCP protocol).
3. Skip CONNECT command: Do not send the required NVMe CONNECT command, leaving command data structures (cmd->req.sg and cmd->iov) uninitialized (NULL).
4. Send malicious H2C_DATA PDU: Immediately transmit a crafted H2C_DATA (Host-to-Controller Data) PDU targeting an uninitialized command slot. The kernel's nvmet_tcp_handle_h2c_data_pdu() will pass control to nvmet_tcp_build_pdu_iovec(), which dereferences the NULL pointers.
5. Trigger kernel crash: The NULL pointer dereference causes a kernel oops or panic, crashing the target system or rendering it unresponsive (Red Hat Bugzilla).

• Network: Unexpected or malformed NVMe-TCP H2C_DATA PDUs arriving on TCP ports 4420 or 8009 immediately after connection establishment, without a preceding CONNECT command; connections from unknown or unauthorized initiator IPs to NVMe-TCP target ports.
• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg referencing nvmet_tcp_build_pdu_iovec or nvmet_tcp_handle_h2c_data_pdu with NULL pointer dereference traces; sudden system reboots or kernel crash dumps on NVMe-TCP target hosts.
• System: Unexpected kernel crash dump files (e.g., /var/crash/) generated on NVMe-TCP target systems; repeated system restarts on hosts serving NVMe-over-TCP storage.

Upgrade the Linux kernel to a patched version: 5.5+ (for 5.4.x branch), 5.10.249+ (5.10.x), 5.15.199+ (5.15.x), 6.1.162+ (6.1.x), 6.6.122+ (6.6.x), 6.12.67+ (6.12.x), or 6.18.7+ (6.18.x). Stable kernel patches are available via git.kernel.org (commits: 32b63acd78f5, 374b095e265f, 3def52431507, 76abc83a9d25, 7d75570002929, baabe43a0ede, fdecd3b6aac1). Red Hat has issued fixes via RHSA-2026:2264 (RHEL 8), RHSA-2026:2378 (RHEL 8), RHSA-2026:2721 (RHEL 10), and RHSA-2026:2722 (RHEL 9). As a workaround where patching is not immediately possible, restrict network access to NVMe-TCP target ports (4420/tcp, 8009/tcp) using firewall rules to trusted initiators only, or disable the nvmet-tcp kernel module if NVMe-over-TCP target functionality is not required (Red Hat Bugzilla, Red Hat Advisory).

Red Hat triaged the vulnerability at medium severity and issued four errata (RHSA-2026:2264, 2378, 2721, 2722) addressing RHEL 8, 9, and 10. AlmaLinux, Rocky Linux, Oracle Linux, SUSE, and Ubuntu have all issued corresponding advisories and updated kernel packages. The vulnerability received routine coverage from Linux security aggregators (linuxsecurity.com, pro-linux.de, linuxcompatible.org) without significant broader media attention, consistent with its denial-of-service-only impact and lack of confirmed in-the-wild exploitation (Red Hat Advisory, Red Hat Bugzilla).