CVE-2026-52989
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In the Linux kernel's NVMe-over-TCP driver, a vulnerability was found where nvmet_tcp_build_pdu_iovec() fails to propagate errors (e.g., out-of-bounds PDU length) to its callers. Consequently, callers like nvmet_tcp_handle_h2c_data_pdu() proceed with an uninitialized message iterator, potentially reading network data into an invalid buffer.
Risk Assessment
The risk includes potential data corruption, memory corruption, or unpredictable system behavior, which could allow an attacker to remotely disrupt the NVMe-over-TCP service.
Recommendation
It is recommended to immediately update the Linux kernel to a version containing the fix that propagates errors from nvmet_tcp_build_pdu_iovec() to callers, preventing the use of uninitialized data.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.