CVE-2026-89969: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
nvmettcptryrecvpdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining payload length as
queue->left = hdr->hlen - queue->offset + hdgst;
and reads that many more bytes into &queue->pdu + queue->offset, without ever bounding the result against sizeof(queue->pdu).
A struct nvmetcpicreqpdu is itself 128 bytes, exactly the size of the union. Once a header digest has been negotiated (hdgst = 4), a second ICReq passes the hlen == nvmettcppdusize() check but yields queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the 128-byte buffer -- 4 bytes past its end, over queue->hdrdigest and queue->datadigest. Those bytes are attacker-controlled (an ICReq carries no digest), and the duplicate ICReq is only rejected later, after the overflow. A remote unauthenticated host can thus corrupt kernel memory adjacent to the receive buffer.
Reject any PDU whose declared length would read past the end of queue->pdu before the second recv.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the nvmet-tcp fix so that when a header digest has been negotiated (hdgst = 4), any PDU whose declared length would read past the end of the receive buffer is rejected (prevent out-of-bounds write during nvmet_tcp_try_recv_pdu()).
Linux kernel nvmet-tcp hdr digest negotiation/hdgst handling = Reject duplicate/over-long PDUs whose declared length would read past the end of the receive buffer after header digest negotiation (hdgst = 4)
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel NVMe over TCP target implementation are exposed if they accept remote NVMe/TCP connections. The vulnerable receive path can be reached by a remote unauthenticated host.
What does an attacker need to exploit the overflow?
An attacker needs network access to the NVMe/TCP target and must send an over-long PDU. The described trigger uses a second ICReq after header-digest negotiation, causing attacker-controlled bytes to overwrite memory immediately following the fixed receive buffer.
Is header-digest negotiation relevant to exploitation?
Yes. In the described path, negotiation of a 4-byte header digest makes a duplicate ICReq result in a read that extends four bytes beyond the 128-byte queue->pdu buffer.