CVE-2026-98723: nvmet: copy the hostid into the ctrl before creating PR pc_refs

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nvmet: copy the hostid into the ctrl before creating PR pc_refs

Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and
implementation") added a second uuid_copy() of args->hostid near the end
of nvmet_alloc_ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate
uuid_copy") removed the original copy that sat before
nvmet_ctrl_init_pr() instead of the new one.

Since then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the
per-controller per-namespace reservation refs while the uuid_copy()
from the connect data runs later, after the controller is published.
The ctrl is allocated with kzalloc(), so every pc_ref created on this
path stores the nil UUID.

pc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort()
matches it against the preempted registrant's hostid to kill and drain
the victim's in-flight I/O for Preempt and Abort.  The match can never
hit with the nil UUID, so whenever a namespace with reservations
enabled exists before a host connects, which includes every reconnect,
Preempt and Abort silently degrades into a plain Preempt: the
preempting host sees success while the victim's in-flight I/O is still
in the air.

Copy the hostid where the rest of the connect data is consumed, before
the controller is published and before nvmet_ctrl_init_pr() takes its
snapshot.

The Linux kernel CVE team has assigned CVE-2026-98723 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.15 with commit 7b658153f1b8a79ed98980f2fef7b92a66aeb9cd and fixed in 6.18.56 with commit d3d6d7efdacc08616d23b3ac42272a494951dc0f
	Issue introduced in 6.15 with commit 7b658153f1b8a79ed98980f2fef7b92a66aeb9cd and fixed in 7.2.10 with commit 23194531595c5d1d4454e3a607b0c8fc0c4e8695
	Issue introduced in 6.15 with commit 7b658153f1b8a79ed98980f2fef7b92a66aeb9cd and fixed in 7.3-rc6 with commit 5211fed41d7ec90e9ab7239dc4bffffe4d0b2b62

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98723
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/nvme/target/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d3d6d7efdacc08616d23b3ac42272a494951dc0f
	https://git.kernel.org/stable/c/23194531595c5d1d4454e3a607b0c8fc0c4e8695
	https://git.kernel.org/stable/c/5211fed41d7ec90e9ab7239dc4bffffe4d0b2b62