Linux nvmet-tcp: unsolicited H2CData PDU double-completes a command and wedges the target

Impact

A host that can open an NVMe/TCP connection to the target can send an H2CData PDU for a write command before the target has sent the matching R2T. The command completes twice, the response llist node is made self-referential, and the target either hits a list_add BUG with CONFIG_DEBUG_LIST or spins forever in the nvmet_tcp workqueue as a soft lockup. On a storage node exporting namespaces to a GPU fleet that takes out shared scratch or dataset storage for every tenant behind it, and recovery is a reboot of the target box, not a service restart. The commit message states it is remotely triggerable with no authentication on an allow_any_host subsystem, which is a common configuration on trusted storage VLANs.

Who can reach it

Anyone who can reach the NVMe/TCP target port on the storage network. No authentication is needed when the subsystem is configured allow_any_host; otherwise a host permitted to connect.

What to do

Take the stable kernel containing the fix (the commit adds an R2T-sent flag and rejects early H2CData) and reboot the target node. No upstream mitigation short of patching is described; restricting which hosts can reach the target port and moving off allow_any_host reduces exposure in the meantime. The advisory names no fixed release numbers, only the stable commits.

References

Related entries

• Linux NVMe host: a positive Identify status is ignored and a zoned queue is set up with zero zone sizeCVE-2026-89971 · Linux kernel NVMe host (zoned namespace limits update)High
• Linux nvme-fc: double free of fabrics options when nvme_add_ctrl() fails during connectCVE-2026-89974 · Linux kernel nvme-fc (fabrics options ownership on controller init failure)High
• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh
• Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootCVE-2023-1829 · Linux kernel (net/sched tcindex)High
• QEMU: missing iov bounds check in the virtio-snd input callback gives a guest a heap out-of-bounds writeCVE-2026-3195 · QEMU virtio-snd device (virtio_snd_pcm_in_cb input callback)High