CVE-2026-98724

In the Linux kernel, the following vulnerability has been resolved:

nvmet: pci-epf: reject too-short SGL segments

The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr descs zero, so nvmet pci epf get sgl segment() reads the type byte of sgls[-1] outside the allocated buffer. If that byte contains a segment descriptor type, the function also copies the preceding 16 bytes and returns a negative descriptor count.

The read was reproduced in 3/3 KASAN boots with only the host transfer mocked by a KUnit test:

BUG: KASAN: slab-out-of-bounds in nvmet pci epf get sgl segment Read of size 1 by task kunit try catch Call Trace: nvmet pci epf get sgl segment nvmet pci epf short sgl test Kernel panic - not syncing: KASAN: panic on warn set ...

Reject segments that cannot hold one descriptor before allocating or transferring their contents.