CVE-2026-98723

In the Linux kernel, the following vulnerability has been resolved:

nvmet: copy the hostid into the ctrl before creating PR pc refs

Commit 6202783184bf ("nvmet: Improve nvmet alloc ctrl() interface and implementation") added a second uuid copy() of args->hostid near the end of nvmet alloc ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate uuid copy") removed the original copy that sat before nvmet ctrl init pr() instead of the new one.

Since then nvmet ctrl init pr() snapshots ctrl->hostid into the per-controller per-namespace reservation refs while the uuid copy() from the connect data runs later, after the controller is published. The ctrl is allocated with kzalloc(), so every pc ref created on this path stores the nil UUID.

pc ref->hostid has a single consumer: nvmet pr set ctrl to abort() matches it against the preempted registrant's hostid to kill and drain the victim's in-flight I/O for Preempt and Abort. The match can never hit with the nil UUID, so whenever a namespace with reservations enabled exists before a host connects, which includes every reconnect, Preempt and Abort silently degrades into a plain Preempt: the preempting host sees success while the victim's in-flight I/O is still in the air.

Copy the hostid where the rest of the connect data is consumed, before the controller is published and before nvmet ctrl init pr() takes its snapshot.