CyberSecBulletin
CVE-2026-22998NVD status: Modified

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-22998 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions baabe43a0edefac8cd7b981ff87f967f6034dafe, 76abc83a9d25593c2b7613c549413079c14a4686, 7d75570002929d20e40110d6b03e46202c9d1bc7 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.78% chance of exploitation within 30 days, higher than 56% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to baabe43a0edefac8cd7b981ff87f967f6034dafe or 76abc83a9d25593c2b7613c549413079c14a4686 or 7d75570002929d20e40110d6b03e46202c9d1bc7 or fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.5 or 5.10.249 or 5.15.199 or 6.1.162, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxf775f2621c2ac5cc3a0b3a64665dad4fb146e510 up to, but not including, baabe43a0edefac8cd7b981ff87f967f6034dafe; 4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d up to, but not including, 76abc83a9d25593c2b7613c549413079c14a4686; 2871aa407007f6f531fae181ad252486e022df42 up to, but not including, 7d75570002929d20e40110d6b03e46202c9d1bc7; 24e05760186dc070d3db190ca61efdbce23afc88 up to, but not including, fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4; efa56305908ba20de2104f1b8508c6a7401833be up to, but not including, 3def5243150716be86599c2a1767c29c68838b6d; efa56305908ba20de2104f1b8508c6a7401833be up to, but not including, 374b095e265fa27465f34780e0eb162ff1bef913; efa56305908ba20de2104f1b8508c6a7401833be up to, but not including, 32b63acd78f577b332d976aa06b56e70d054cbba; ee5e7632e981673f42a50ade25e71e612e543d9d; and 8 more rangesbaabe43a0edefac8cd7b981ff87f967f6034dafe, 76abc83a9d25593c2b7613c549413079c14a4686, 7d75570002929d20e40110d6b03e46202c9d1bc7, fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4, 3def5243150716be86599c2a1767c29c68838b6d, 374b095e265fa27465f34780e0eb162ff1bef913
LinuxLinux Kernel5.4.268 up to, but not including, 5.5; 5.10.209 up to, but not including, 5.10.249; 5.15.148 up to, but not including, 5.15.199; 6.1.75 up to, but not including, 6.1.162; 6.6.14 up to, but not including, 6.6.122; 6.7.2 up to, but not including, 6.12.67; 6.13 up to, but not including, 6.18.7; 6.195.5, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighCNA
CVSS 3.17.5HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate whether the command's data structures (cmd->req.sg and cmd->iov) have been properly initialized before processing H2C_DATA PDUs. The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command. Attack vectors that trigger NULL pointer dereferences: 1. H2C_DATA PDU sent before CONNECT → both pointers NULL 2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL 3. H2C_DATA PDU for uninitialized command slot → both pointers NULL The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because: - Uninitialized commands: both NULL - READ commands: cmd->req.sg allocated, cmd->iov NULL - WRITE commands: both allocated

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.