Linux nvmet-tcp: unsolicited H2CData PDU double-completes a command and wedges the target

Impact

A host that can open an NVMe/TCP connection to the target can send an H2CData PDU for a write command before the target has sent the matching R2T. The command completes twice, the response llist node is made self-referential, and the target either hits a list_add BUG with CONFIG_DEBUG_LIST or spins forever in the nvmet_tcp workqueue as a soft lockup. On a storage node exporting namespaces to a GPU fleet that takes out shared scratch or dataset storage for every tenant behind it, and recovery is a reboot of the target box, not a service restart. The commit message states it is remotely triggerable with no authentication on an allow_any_host subsystem, which is a common configuration on trusted storage VLANs.

Who can reach it

Anyone who can reach the NVMe/TCP target port on the storage network. No authentication is needed when the subsystem is configured allow_any_host; otherwise a host permitted to connect.

What to do

Take the stable kernel containing the fix (the commit adds an R2T-sent flag and rejects early H2CData) and reboot the target node. No upstream mitigation short of patching is described; restricting which hosts can reach the target port and moving off allow_any_host reduces exposure in the meantime. The advisory names no fixed release numbers, only the stable commits.

References

Related entries

• Linux NVMe host: a positive Identify status is ignored and a zoned queue is set up with zero zone sizeCVE-2026-89971 · Linux kernel NVMe host (zoned namespace limits update)High
• Linux nvme-fc: double free of fabrics options when nvme_add_ctrl() fails during connectCVE-2026-89974 · Linux kernel nvme-fc (fabrics options ownership on controller init failure)High
• Linux kernel NFSv4 client: dropped delegations leave the state manager looping on revoked stateCVE-2026-90234 · Linux kernel NFSv4 client (delegation handling in nfs_inode_set_delegation)High
• Linux qla2xxx: dying NPIV vport re-inserted into host_map during report ID acquisition, causing use-after-freeCVE-2026-97531 · Linux kernel scsi/qla2xxx (report ID acquisition vs. vport deletion)High
• Linux qla2xxx: pending qpair work runs after response queue teardown, causing use-after-freeCVE-2026-97536 · Linux kernel scsi/qla2xxx (queue pair teardown, qla25xx_free_rsp_que)High
• Linux nvme: sparse NSID gaps make namespace scan iterate billions of times, causing soft lockupCVE-2026-98056 · Linux kernel nvme core (nvme_scan_ns_list stale-namespace removal)High