An NVMe over TCP controller can send a Read Response (R2T) for a read command, but the Linux kernel’s nvme_tcp_handle_r2t() does not verify that the R2T corresponds to a write request. As a result, the host transmits the contents of the read buffer—kernel memory—to the controller, allowing an attacker read arbitrary host kernel memory, including stale page structures, without any logs or authentication bypass.

All Linux kernel implementations that ship the default nvme over TCP module and have not been updated to include the commit that adds the R2T direction check are affected. This includes every distribution that uses the stock nvme_tcp module prior to the patch revision identified by commit 3a0b0514.

The CVSS base score of 7.4 indicates high severity, while the EPSS score of less than 1 % shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a malicious NVMe controller connected to the host’s NVMe/TCP is a physical or network-level attack. Exploitation requires the controller to issue an R2T for a READ; it is not detectable in logs and does not require privileged credentials.