CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: fix host memory disclosure on R2T for a read command
nvmetcphandler2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvmetcpsetuph2cdatapdu() builds the H2CData header and nvmetcptrysenddata() sends the request's data buffer. That buffer is the READ destination, so its contents go to the controller.
The command then completes normally and nothing is logged.
Against a test controller that answers every READ with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained stale kernel data, including an array of struct page pointers.
Reject an R2T for a request that is not a write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel nvme-tcp code path so that nvme_tcp_handle_r2t() rejects an R2T when the associated request is not a write (i.e., do not use READ destination buffers for R2T handling that could disclose stale host memory).
Linux kernel nvme-tcp R2T handling for READ direction = Reject an R2T for a request that is not a write
Event History
Frequently Asked Questions
Which systems are exposed to disclosure?
Linux hosts using NVMe/TCP are exposed when they issue read commands to a malicious controller. The controller can cause the host to transmit the read destination buffer back to the controller.
What does an attacker need to exploit this issue?
The attacker needs to operate or control an NVMe/TCP controller that can send an R2T message in response to a read command. A malicious controller can request data for the read request even though R2T should apply only to writes.
Can this be detected from normal host logs or command failures?
Not reliably from the behavior described. The read command completes normally and nothing is logged, even when host memory contents are disclosed.
What is the required remediation?
Apply a kernel update containing the fix that rejects an R2T for any request that is not a write. The referenced stable commits provide the relevant fixes.