CVE-2026-98724

A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) target PCI endpoint function driver. When processing a Scatter-Gather List (SGL) segment whose length is shorter than a single descriptor, the system fails to properly validate the segment size. A connected host can exploit this vulnerability by submitting a malformed SGL segment, triggering an out-of-bounds memory read. This issue primarily allows an attacker to cause a kernel crash leading to a Denial of Service (DoS), or potentially expose sensitive memory contents.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.