NVMe/TCP host: C2HData for a WRITE_ZEROES command writes into a stale iterator

Impact

The receive side gates an incoming C2HData PDU on blk_rq_payload_bytes() alone, without the blk_rq_nr_phys_segments() check that the submit side uses. REQ_OP_WRITE_ZEROES has no physical segments but a non-zero blk_rq_bytes(), so setup leaves req->iter untouched while the receive gate still lets the controller's data through, and nvme_tcp_recv_data() copies into whatever the previous command on that tag left in the iterator. The driver-private area is only zeroed when the tag set is allocated, so the stale pointer is real: the reporter shows KASAN reporting a wild-memory-access write of 512 bytes. A malicious or malfunctioning target therefore gets a controlled kernel write at an address it does not choose but the host does not validate - in practice a node crash, and potentially memory corruption on a host serving multiple tenants.

Who can reach it

The NVMe/TCP target, or anyone who can impersonate it on the storage network. Requires an active NVMe/TCP session and a WRITE_ZEROES command (discard/zeroing traffic) to land on a reused tag.

What to do

Update the host kernel to a stable release with the tightened receive gate (four stable commits linked) and reboot each NVMe/TCP client node. There is no configuration switch that disables WRITE_ZEROES issuance safely across all filesystems, so segmenting and authenticating the storage path is the only interim mitigation. No fixed release number is given.

References

Related entries

• Linux kernel nvme: discard fallback page is never zeroed, leaking kernel memory to the controllerCVE-2026-89483 · Linux kernel nvme core (DSM discard fallback page)Unscored
• Linux CephFS client: leaked inode reference on aborted writeback panics the node at umountCVE-2026-89646 · Linux kernel CephFS client (ceph_submit_write writeback abort at umount)Unscored
• Linux CephFS client: cap reclaim work busy-loops, burning CPU and contending dentry_list_lockCVE-2026-89647 · Linux kernel CephFS client (ceph_cap_reclaim_work / ceph_trim_dentries busy loop)Unscored
• Linux CephFS client: unbounded delegated-inode intervals let a hostile MDS burn client CPU and memoryCVE-2026-89648 · Linux kernel CephFS client (ceph_parse_deleg_inos delegated inode count)Unscored
• Linux CephFS client: unchecked final xattr value length leaks kernel heap via getxattr(2)CVE-2026-89649 · Linux kernel CephFS client (__build_xattrs xattr value length)Unscored
• Linux CephFS client: out-of-bounds read decoding MDS map info v2/v3 export targetsCVE-2026-89650 · Linux kernel CephFS client (ceph_mdsmap_decode num_export_targets)Unscored