High

CVE-2026-98964 — nvmet: use the local P2P device on metadata allocation failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails, out_free_sg passes req->p2p_dev to pci_p2pmem_free_sgl() before that assignment has taken place. Pass the local p2p_dev argument instead, so cleanup uses the same PCI device as the successful data allocation.

Published Oct 23, 2026 · Updated Oct 30, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP, GitHub Security Advisories · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.5% (30-day exploitation probability)+7
Technical severity (high)+6

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.54%

ahead of 45% of scored CVEs · Oct 30, 2026

Affects

Linux

CVSS base

7.5

High · 3 source(s)

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
The attack is network-based and needs no privileges: restrict exposure (ACLs, VPN, WAF) until patched.
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ bcd9a0797d73eeff659582f23277e7ab6e5f18f3 and < 3c231142c4f4bb96836469eb276026ec55940093≥ bcd9a0797d73eeff659582f23277e7ab6e5f18f3 and < 32f21607911a1f69c8f0f93a6c28fe6f8490aa98≥ bcd9a0797d73eeff659582f23277e7ab6e5f18f3 and < ce79a6c5cc1b8054ec8d3eba16adda4a36113438≥ bcd9a0797d73eeff659582f23277e7ab6e5f18f3 and < 73bf0f9579633b531098a475e6e55c9316763aed≥ bcd9a0797d73eeff659582f23277e7ab6e5f18f3 and < 4aa9c0f377a4de5e8fddce76b34ee4529639a1ffversion 8a452d62e7cea3c8a2676a3b89a9118755a1a271≥ 5.12.10 and < 5.13version 5.13 and 4 more ≥ c440cd080761b18a52cac20f2a42e5da1e3995af and < eb72e2eeff559eb1eb07b1d644ce2bc1a16c4a80≥ bcd9a0797d73eeff659582f23277e7ab6e5f18f3 and < 48c8b59429d09a7c3598de425acbc2d3f4e6647b≥ bcd9a0797d73eeff659582f23277e7ab6e5f18f3 and < e8f24ae4f45efe6861f801c6ebd2789c9016f1bc≥ 5.10.43 and < 5.10.273	Vulnerable	CVE Program (cve.org) e CISA ADP

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Scored by
7.5	CVSS 3.1	High	3.9	3.6	416baaa9-dc9f-4396-8d5f-8c081fb06d67 via NIST National Vulnerability Database
7.5	CVSS 3.1	High	—	—	GitHub, Inc. via GitHub Security Advisories
7.5	CVSS 3.1	High	—	—	Linux via CVE Program (cve.org) e CISA ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score shown at the top: 416baaa9-dc9f-4396-8d5f-8c081fb06d67)

EPSS over time FIRST

Oct 24, 2026 → Oct 30, 2026 · 7 reading(s) · max 0.54%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Prioritize edge telemetry for the network-reachable component (proxy, WAF, IDS/IPS).

web/proxy/WAF logsnetwork IDS/IPS

Timeline

What happened to this CVE, newest first.

2026
Affected products removed · 2
Oct 30, 2026 · CVE Program (cve.org) e CISA ADP
Affected products added · linux/linux
Oct 30, 2026 · CVE Program (cve.org) e CISA ADP
CVSS changed · 7.5
Oct 24, 2026 · NIST National Vulnerability Database
Record published
Oct 23, 2026
Affected products added · linux/linux
Oct 23, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Received
Oct 23, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 23, 2026 · Alertas do Telegram
CVE published
Oct 23, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

3× References added · Oct 23, 2026 – Oct 30, 2026
1× Official description updated · Oct 23, 2026 – Oct 23, 2026

References

10 on the record

git.kernel.org/stable/c/3c231142c4f4bb96836469eb276026ec55940093
NIST National Vulnerability Database
github.com/advisories/GHSA-8vjr-8rg3-pvjv
GitHub Security Advisories
git.kernel.org/stable/c/32f21607911a1f69c8f0f93a6c28fe6f8490aa98
NIST National Vulnerability Database
git.kernel.org/stable/c/ce79a6c5cc1b8054ec8d3eba16adda4a36113438
NIST National Vulnerability Database
nvd.nist.gov/vuln/detail/CVE-2026-98964
GitHub Security Advisories
git.kernel.org/stable/c/eb72e2eeff559eb1eb07b1d644ce2bc1a16c4a80
CVE Program (cve.org) e CISA ADP
git.kernel.org/stable/c/4aa9c0f377a4de5e8fddce76b34ee4529639a1ff
NIST National Vulnerability Database
git.kernel.org/stable/c/e8f24ae4f45efe6861f801c6ebd2789c9016f1bc
CVE Program (cve.org) e CISA ADP
git.kernel.org/stable/c/73bf0f9579633b531098a475e6e55c9316763aed
NIST National Vulnerability Database
git.kernel.org/stable/c/48c8b59429d09a7c3598de425acbc2d3f4e6647b
CVE Program (cve.org) e CISA ADP

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Unknown CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths 2d
Unknown CVE-2026-99215 power: supply: core: prevent unregistering a power supply while a callback runs 2d
Unknown CVE-2026-99207 scsi: target: Disable interrupts while holding delayed_cmd_lock 2d
Unknown CVE-2026-99208 drm/xe/oa: Zero OA buffer at allocation 2d
Unknown CVE-2026-99209 drm/xe: skip eviction of a BO with no resource 2d
Unknown CVE-2026-99210 accel/rocket: clear rdev on device init failure 2d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-98964 is "nvmet: use the local P2P device on metadata allocation failure", rated High. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 7.5 describes technical severity. EPSS 0.54% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.