{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  nvmet: pci-epf: reject too-short SGL segments  The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr_descs zero, so nvmet_pci_epf_get_sgl_segment() reads the type byte of sgls[-1] outside the allocated buffer. If that byte contains a segment descriptor type, the function also copies the preceding 16 bytes and returns a negative descriptor count.  The read was reproduced in 3/3 KASAN boots with only the host transfer mocked by a KUnit test:    BUG: KASAN: slab-out-of-bounds in nvmet_pci_epf_get_sgl_segment   Read of size 1 by task kunit_try_catch   Call Trace:    nvmet_pci_epf_get_sgl_segment    nvmet_pci_epf_short_sgl_test   Kernel panic - not syncing: KASAN: panic_on_warn set ...  Reject segments that cannot hold one descriptor before allocating or transferring their contents.",
  "id": "DEBIAN-CVE-2026-98724",
  "modified": "2026-10-19T04:47:29.071250438Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98724"
    }
  ],
  "upstream": [
    "CVE-2026-98724"
  ]
}