CVE-2026-89482

nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

Published Sep 11, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

Commit 25e5cb780e62 ("nvme-tcp: fix possible crash in write_zeroes
processing") established that blk_rq_payload_bytes() must not be read
without first checking blk_rq_nr_phys_segments(), and recorded the
result in nvme_tcp_setup_cmd_pdu() as req->data_len. The receive side
was left as it was.

The two differ for REQ_OP_WRITE_ZEROES, which has no physical segments
but a non-zero blk_rq_bytes(), so setup leaves req->iter untouched
while the receive gate lets a C2HData through and nvme_tcp_recv_data()
copies into whatever the previous command on that tag left there. The
driver-private area is zeroed only when the tag set is allocated.

Reproduced with a test target that leaves a residual iterator on a tag
and then sends a C2HData for a WRITE_ZEROES command on the same tag:

BUG: KASAN: wild-memory-access in _copy_to_iter+0x642/0x1330
Write of size 512 at addr ffe728c2175dfa81 by task kworker/0:1H/103

CPU: 0 UID: 0 PID: 103 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvme_tcp_wq nvme_tcp_io_work
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
kasan_report+0xce/0x100
? _copy_to_iter+0x642/0x1330
kasan_check_range+0x105/0x1b0
__asan_memcpy+0x3c/0x60
_copy_to_iter+0x642/0x1330
? __pfx_sock_has_perm+0x10/0x10
? worker_thread+0x45b/0xd10
? __pfx__copy_to_iter+0x10/0x10
? _raw_spin_lock_bh+0x83/0xe0
? __pfx__raw_spin_lock_bh+0x10/0x10
__skb_datagram_iter+0xf3/0x820
? __pfx_simple_copy_to_iter+0x10/0x10
? __asan_memcpy+0x3c/0x60
? skb_copy_bits+0x58d/0x830
skb_copy_datagram_iter+0x37/0x120
nvme_tcp_recv_skb+0xa07/0x4320
? __pfx_nvme_tcp_recv_skb+0x10/0x10
__tcp_read_sock+0x1ab/0x810
? __pfx_nvme_tcp_recv_skb+0x10/0x10
? __pfx_lock_sock_nested+0x10/0x10
? __pfx___tcp_read_sock+0x10/0x10
nvme_tcp_try_recv+0x152/0x1e0
? __pfx_nvme_tcp_try_recv+0x10/0x10
? __pfx_mutex_unlock+0x10/0x10
nvme_tcp_io_work+0x1e4/0x6c0
? __schedule+0x181a/0x49f0
? __pfx_nvme_tcp_io_work+0x10/0x10
process_one_work+0x633/0x1030

Keep the blk_rq_payload_bytes() test and add req->data_len to it. The
old test is what rejects a C2HData naming a tag that is no longer in
flight, because blk_update_request() zeroes rq->__data_len on
completion; req->data_len and req->curr_bio are driver-private and
survive completion, so they cannot stand in for it. Setup initialises
the iterator only when both req->curr_bio and req->data_len are set, so
the gate now tests the same two.

Analysis

Technical impact

Based on the description, it is inferred that the Linux kernel nvme-tcp subsystem can process a crafted C2HData packet that requests a WRITE_ZEROES operation while a residual iterator from a previous request remains on the same tag. Because the kernel reads the payload size without verifying the physical segment count, it copies the data into memory that no longer belongs to the current request, triggering a wild memory access that kills the kernel. The resulting crash provides a remote denial of service since an attacker can send the malformed NVMe-over-TCP frame from outside the host.

Affected Systems

All Linux kernel builds that include the nvme-tcp subsystem and have not yet incorporated the commit 25e5cb780e62, which implements a check of req->data_len to that commit. Distribution kernel packages built before the fix are therefore affected.

Risk and Exploitability

Based on the description, it is inferred that the attack vector is network-based, using NVMe-over-TCP frames sent over TCP sockets. With a CVSS score of 9.8 the defect is critical, yet its EPSS score is under 1%, suggesting a low probability of exploitation in the wild. An attacker who can reach the target on the NVMe-over-TCP interface can cause a kernel panic, resulting in a denial of service. The issue is not listed in the CISA KEV catalog, so no public exploitation reports exist at this time.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`25e5cb780e62bde432b401f312bb847edc78b432`	affected	< 32ea8ce96b9bd797c59c351ce490ffd97adaa8c0
`25e5cb780e62bde432b401f312bb847edc78b432`	affected	< dd8906bb8f8d5bf1c9f861e1382c82b87bfe7cab
`25e5cb780e62bde432b401f312bb847edc78b432`	affected	< 7ed0b61bbc145988be292c4d3ec580aebd8d2bcd
`25e5cb780e62bde432b401f312bb847edc78b432`	affected	< b96e1ff75e5c0ad6e077ac002b1d30b0a2b49528
`25e5cb780e62bde432b401f312bb847edc78b432`	affected	< b36161701cb366f416afdcf70771d432a7c74753
`25e5cb780e62bde432b401f312bb847edc78b432`	affected	< 6a01b58263108eaf9869bb6f82f07709240c6589
`25e5cb780e62bde432b401f312bb847edc78b432`	affected	< 641ad3a30ba560f0a9a610376c568d7b75d2a2aa
`25e5cb780e62bde432b401f312bb847edc78b432`	affected	< 3a4aa9e6ad3e35f8e24d5eaf38ee4d437075fb36
`f507ae6e33cbe56c4e3fe000434fc0ecc263d098`	affected	—
`b1458c16f4e26e87492e58e4d24a1873bd09232a`	affected	—
`5.4.36`	affected	< 5.5
`5.6.8`	affected	< 5.7

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[25e5cb780e62bde432b401f312bb847edc78b432,b36161701cb366f416afdcf70771d432a7c74753)`	affected	code_commit	—
`[25e5cb780e62bde432b401f312bb847edc78b432,6a01b58263108eaf9869bb6f82f07709240c6589)`	affected	code_commit	—
`[25e5cb780e62bde432b401f312bb847edc78b432,641ad3a30ba560f0a9a610376c568d7b75d2a2aa)`	affected	code_commit	—
`[25e5cb780e62b847edc78b432,3a4aa9e6ad3e35f8e24d5eaf38ee4d437075fb36)`	affected	code_commit	—
`f507ae6e33cbe56c4e3fe000434fc0ecc263d098`	affected	code_commit	—
`b1458c16f4e26e87492e58e4d24a1873bd09232a`	affected	code_commit	—
`[5.4.36,5.5)`	affected	generic	—
`[5.6.8,5.7)`	affected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	generic	—
`7.3-rc1`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains commit 25e5cb780e62 or later, which adds a req->data_len check before accepting C2H data.
Disable the nvme-tcp target or block the network interface that receives NVMe-over-TCP commands if the functionality is not required.
Restrict access to the NVMe-over-TCP service to trusted networks and apply firewall rules to limit incoming connections to that port.
Continuously monitor kernel logs for KASAN messages or unexpected panics to detect potential exploitation attempts.

Generated by OpenCVE AI on September 15, 2026 at 22:45 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.714% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/32ea8ce96b9bd797c59c351ce490ffd97adaa8c0
https://git.kernel.org/stable/c/3a4aa9e6ad3e35f8e24d5eaf38ee4d437075fb36
https://git.kernel.org/stable/c/641ad3a30ba560f0a9a610376c568d7b75d2a2aa
https://git.kernel.org/stable/c/6a01b58263108eaf9869bb6f82f07709240c6589
https://git.kernel.org/stable/c/7ed0b61bbc145988be292c4d3ec580aebd8d2bcd
https://git.kernel.org/stable/c/b36161701cb366f416afdcf70771d432a7c74753
https://git.kernel.org/stable/c/b96e1ff75e5c0ad6e077ac002b1d30b0a2b49528
https://git.kernel.org/stable/c/dd8906bb8f8d5bf1c9f861e1382c82b87bfe7cab
https://nvd.nist.gov/vuln/detail/CVE-2026-89482
https://www.cve.org/CVERecord?id=CVE-2026-89482

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/32ea8ce96b9bd797c59c351ce490ffd97adaa8c0 https://git.kernel.org/stable/c/7ed0b61bbc145988be292c4d3ec580aebd8d2bcd https://git.kernel.org/stable/c/b96e1ff75e5c0ad6e077ac002b1d30b0a2b49528 https://git.kernel.org/stable/c/dd8906bb8f8d5bf1c9f861e1382c82b87bfe7cab

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89482 https://www.cve.org/CVERecord?id=CVE-2026-89482
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Commit 25e5cb780e62 ("nvme-tcp: fix possible crash in write_zeroes processing") established that blk_rq_payload_bytes() must not be read without first checking blk_rq_nr_phys_segments(), and recorded the result in nvme_tcp_setup_cmd_pdu() as req->data_len. The receive side was left as it was. The two differ for REQ_OP_WRITE_ZEROES, which has no physical segments but a non-zero blk_rq_bytes(), so setup leaves req->iter untouched while the receive gate lets a C2HData through and nvme_tcp_recv_data() copies into whatever the previous command on that tag left there. The driver-private area is zeroed only when the tag set is allocated. Reproduced with a test target that leaves a residual iterator on a tag and then sends a C2HData for a WRITE_ZEROES command on the same tag: BUG: KASAN: wild-memory-access in _copy_to_iter+0x642/0x1330 Write of size 512 at addr ffe728c2175dfa81 by task kworker/0:1H/103 CPU: 0 UID: 0 PID: 103 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: nvme_tcp_wq nvme_tcp_io_work Call Trace: <TASK> dump_stack_lvl+0x53/0x70 kasan_report+0xce/0x100 ? _copy_to_iter+0x642/0x1330 kasan_check_range+0x105/0x1b0 __asan_memcpy+0x3c/0x60 _copy_to_iter+0x642/0x1330 ? __pfx_sock_has_perm+0x10/0x10 ? worker_thread+0x45b/0xd10 ? __pfx__copy_to_iter+0x10/0x10 ? _raw_spin_lock_bh+0x83/0xe0 ? __pfx__raw_spin_lock_bh+0x10/0x10 __skb_datagram_iter+0xf3/0x820 ? __pfx_simple_copy_to_iter+0x10/0x10 ? __asan_memcpy+0x3c/0x60 ? skb_copy_bits+0x58d/0x830 skb_copy_datagram_iter+0x37/0x120 nvme_tcp_recv_skb+0xa07/0x4320 ? __pfx_nvme_tcp_recv_skb+0x10/0x10 __tcp_read_sock+0x1ab/0x810 ? __pfx_nvme_tcp_recv_skb+0x10/0x10 ? __pfx_lock_sock_nested+0x10/0x10 ? __pfx___tcp_read_sock+0x10/0x10 nvme_tcp_try_recv+0x152/0x1e0 ? __pfx_nvme_tcp_try_recv+0x10/0x10 ? __pfx_mutex_unlock+0x10/0x10 nvme_tcp_io_work+0x1e4/0x6c0 ? __schedule+0x181a/0x49f0 ? __pfx_nvme_tcp_io_work+0x10/0x10 process_one_work+0x633/0x1030 Keep the blk_rq_payload_bytes() test and add req->data_len to it. The old test is what rejects a C2HData naming a tag that is no longer in flight, because blk_update_request() zeroes rq->__data_len on completion; req->data_len and req->curr_bio are driver-private and survive completion, so they cannot stand in for it. Setup initialises the iterator only when both req->curr_bio and req->data_len are set, so the gate now tests the same two.
Title		nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3a4aa9e6ad3e35f8e24d5eaf38ee4d437075fb36 https://git.kernel.org/stable/c/641ad3a30ba560f0a9a610376c568d7b75d2a2aa https://git.kernel.org/stable/c/6a01b58263108eaf9869bb6f82f07709240c6589 https://git.kernel.org/stable/c/b36161701cb366f416afdcf70771d432a7c74753