NULL Pointer Dereference Vulnerability in Linux Kernel's NVMe TCP Component
CVE-2026-22998

Currently unrated

Key Information:

Vendor: Linux
Status: Linux
Vendor: CVE Published:; 25 January 2026

What is CVE-2026-22998?

A vulnerability exists in the NVMe TCP implementation of the Linux kernel that could lead to NULL pointer dereferences when processing Host-to-Controller (H2C) Data Protocol Data Units (PDUs). The issue arises because the required command data structures, specifically cmd->req.sg and cmd->iov, are not adequately validated prior to their use. This flaw can be exploited by an attacker sending H2C_DATA PDUs immediately after the Initial Command Request (ICREQ) or Initial Command Response (ICRESP) handshake, potentially resulting in a kernel panic. Corrective measures have been implemented to ensure that these pointers are validated before dereferencing, thereby preventing unintended system behavior.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch