CVE-2026-89481
UnknownSummary
In the Linux kernel, the nvme-tcp driver's nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it, sending the READ destination buffer (containing stale kernel data) to the controller. This leaks host memory, including struct page pointers.
Risk Assessment
Discloses sensitive kernel memory (host memory disclosure) to a malicious or compromised NVMe over TCP controller. Can lead to leakage of sensitive information.
Recommendation
Update the Linux kernel to a version that rejects an R2T for a request that is not a write. Until patched, consider limiting trust in NVMe over TCP controllers.
Other vulnerabilities in Linux kernel (nvme-tcp)
See all- CVE-2026-89482Unknown
In the Linux kernel, the nvme-tcp driver accepted C2HData based solely on blk_rq_payload_bytes() without also checking req->data_len. For REQ_OP_WRITE_ZEROES, which has no physical segments but a non-zero blk_rq_bytes(), this causes data to be copied into an uninitialized iterator, triggering a KASAN wild-memory-access in _copy_to_iter().
- CVE-2026-89480Unknown
In the Linux kernel, the nvme-tcp driver's nvme_tcp_recv_data() completes a request once the current C2HData PDU is consumed, without comparing total bytes received against the length the command asked for. A malicious controller can answer a 4096-byte read with 512 bytes and have it reported as complete, exposing 3584 bytes of stale page data to user space. The fix counts received bytes and refuses to complete an incomplete read.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends the request's data buffer. That buffer is the READ destination, so its contents go to the controller. The command then completes normally and nothing is logged. Against a test controller that answers every READ with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained stale kernel data, including an array of struct page pointers. Reject an R2T for a request that is not a write.