Linux kernel NVMe-oF TCP target (nvmet-tcp, unpropagated PDU iovec build errors): Nvmet_tcp_build_pdu_iovec() detects

CVSS 9.8CVE-2026-52989Firmware, BMC & network fabriccurated

Impact

Nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, flags a fatal error - and returns void. The caller never learns, sets the queue into receive-data state anyway, and the socket loop then reads attacker-supplied network bytes into an uninitialised iov_iter. A remote initiator that sends a malformed PDU length therefore steers kernel writes through an iterator whose contents are whatever was on the stack. The kernel CNA rates it network, unauthenticated, full CIA, and the reasoning is visible in the fix.

Who can reach it

Remote, unauthenticated, by sending a PDU with an out-of-range length or data offset to the nvmet-tcp listener.

What to do

Kernel update making the iovec builder return an error and the callers honour it. Same network containment applies: the storage target's listener must be unreachable from tenant networks.

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=046fa5c72d15cd8e2d592e275697ea399d8f76b0 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52989.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.