Linux kernel nvmet-tcp: over-long PDU writes past the 128-byte receive buffer

Impact

A node exporting NVMe namespaces over TCP can have kernel memory corrupted by any host that can open a connection to the target port, before authentication. Once a header digest is negotiated, a second ICReq makes the target compute a 124-byte read into a 128-byte union at offset 8, writing 4 attacker-controlled bytes over the adjacent hdr_digest and data_digest fields; the duplicate ICReq is only rejected after the overflow has happened. On a GPU fleet this matters wherever storage nodes serve scratch or dataset volumes over NVMe/TCP on the same network tenants can reach - the blast radius is the storage kernel, not a single job, and a corrupted target takes every mounted namespace with it.

Who can reach it

Any host with TCP reach to the nvmet-tcp listener. No authentication required - the overflow occurs during connection setup.

What to do

Update to a kernel carrying the fix (the PDU length is now bounded against sizeof(queue->pdu) before the second recv) and reboot each affected storage node. Until then, restrict the NVMe/TCP listener to a trusted storage VLAN or an allowlist of initiator addresses. The record lists the stable commits but no distribution-fixed version.

References

Related entries

• Linux kernel nvmet-auth: use-after-free when auth timeout work races SQ teardownCVE-2026-89970 · Linux kernel nvmet-auth (NVMe target SQ teardown)Critical
• Linux kernel nvme: missing SRCU grace period on the namespace-allocation error pathCVE-2026-89972 · Linux kernel nvme host (nvme_alloc_ns error path, multipath sibling list)Critical
• Linux kernel CephFS client: use-after-free when an MDS session reopens during an access checkCVE-2026-89990 · Linux kernel CephFS client (ceph_mds_check_access)Critical
• Linux kernel NFSD: client use-after-free when the laundromat reaps a blocked lockCVE-2026-90036 · Linux kernel NFSD (blocked-lock laundromat reaping)Critical
• Linux kernel NFSD: client use-after-free when the laundromat reaps close_lru open ownersCVE-2026-90037 · Linux kernel NFSD (close_lru laundromat reaping)Critical
• Linux kernel NFSD: client use-after-free when an export is removed during client expiryCVE-2026-90038 · Linux kernel NFSD (nfsd4_revoke_export_states, export unlock path)Critical