CVE-2026-52989: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
In the Linux kernel, the following vulnerability has been resolved:
Other sources
nvmet-tcp: propagate nvmettcpbuildpduiovec() errors to its callers
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-2 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.180-1~deb11u1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel NVMe-oF TCP target path (nvmet-tcp) are exposed when they accept NVMe/TCP traffic. The vulnerable processing occurs in the target's handling of host-to-controller data PDUs.
What does an attacker need to exploit the flaw?
An attacker can act remotely over the network and does not need privileges or user interaction. Exploitation involves sending a PDU with an out-of-bounds length or offset that causes PDU I/O-vector construction to fail.
What happens after a malformed PDU triggers the error?
The fatal-error path can leave the receive-message iterator uninitialized, while subsequent handling overwrites the queue receive state. The socket receive loop may then read network data into that uninitialized iterator, with potential impact to confidentiality, integrity, and availability.