nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
Affects the Linux kernel nvmet-tcp target from 5.0 when a header digest is negotiated (hdgst = 4) and a second ICReq is sent. Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51 and 7.2.5.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's NVMe-over-TCP target driver (nvmet-tcp) is affected. A remote, unauthenticated host can send an oversized protocol message that writes past the end of a fixed receive buffer, potentially corrupting adjacent kernel memory.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining payload length as queue->left = hdr->hlen - queue->offset + hdgst; and reads that many more bytes into &queue->pdu + queue->offset, without ever bounding the result against sizeof(queue->pdu). A struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the union. Once a header digest has been negotiated (hdgst = 4), a second ICReq passes the hlen == nvmet_tcp_pdu_size() check but yields queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the 128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and queue->data_digest. Those bytes are attacker-controlled (an ICReq carries no digest), and the duplicate ICReq is only rejected later, after the overflow. A remote unauthenticated host can thus corrupt kernel memory adjacent to the receive buffer. Reject any PDU whose declared length would read past the end of queue->pdu before the second recv.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 872d26a391da92ed8f0c0f5cb5fef428067b7f30 · fixed in a3f0bcfbaf3312a5754d1ce020a07d394669eb25; From 872d26a391da92ed8f0c0f5cb5fef428067b7f30 · fixed in 4f84d42c53c49557fb1ef285c683b0a81b576c74; From 872d26a391da92ed8f0c0f5cb5fef428067b7f30 · fixed in 58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6; From 872d26a391da92ed8f0c0f5cb5fef428067b7f30 · fixed in cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca; From 872d26a391da92ed8f0c0f5cb5fef428067b7f30 · fixed in 3a385e0c39efbe34db8edd95900c123113ae3450; From 872d26a391da92ed8f0c0f5cb5fef428067b7f30 · fixed in dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6; From 872d26a391da92ed8f0c0f5cb5fef428067b7f30 · fixed in d95d342bc0ea82dc79e6362b2f1f997431750e4c; From 872d26a391da92ed8f0c0f5cb5fef428067b7f30 · fixed in 14cc5a7e77731497d5bea70f3bb05df7eda982e4
- Linux Linux
5.0
- KernelLinux
From 5.0.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.5
References 8
git.kernel.org
- stable/c/a3f0bcfbaf3312a5754d1ce020a07d394669eb25
- stable/c/4f84d42c53c49557fb1ef285c683b0a81b576c74
- stable/c/58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6
- stable/c/cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca
- stable/c/3a385e0c39efbe34db8edd95900c123113ae3450
- stable/c/dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6
- stable/c/d95d342bc0ea82dc79e6362b2f1f997431750e4c
- stable/c/14cc5a7e77731497d5bea70f3bb05df7eda982e4
Questions about CVE-2026-89969
What does this mean?
The NVMe/TCP target code can receive a PDU larger than its receive buffer allows, so it writes past the end of that buffer and corrupts adjacent kernel memory.Source: git.kernel.org
Am I affected, and how do I check?
Linux kernel versions from 5.0.0 up to the fixed releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51 and 7.2.5 are in the affected range. The bug needs the nvmet-tcp target with a negotiated header digest (hdgst = 4) and a second ICReq; check the kernel with uname -r and whether the nvmet_tcp module is loaded with lsmod.Source: git.kernel.org
What should I do about it?
Upgrade to the fixed stable release for the kernel branch in use: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, or 7.2.5 or later.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data