CVE-2026-89482

CVE-2026-89482 is a wild-memory-access vulnerability in the Linux kernel's nvme-tcp module. The root cause is an incorrect receive-side gate: for REQ_OP_WRITE_ZEROES commands, blk_rq_payload_bytes() returns a non-zero value despite the absence of physical segments, so the setup phase leaves req-&...

CVE-2026-89482 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in writezeroes processing" established that blkrqpayloadbytes must not be read without first checking...

EUVD-2026-76387

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89481

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89481

CVE-2026-89481 affects the Linux kernel's NVMe over TCP (nvme-tcp) component. The root cause is that nvme_tcp_handle_r2t() does not validate the direction of the request a Ready to Transfer (R2T) refers to. A malicious NVMe controller can send an R2T for a READ command; the host then sends the co...

CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89480

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89480

CVE-2026-89480 affects the NVMe-TCP driver in the Linux kernel. The function nvme_tcp_recv_data() completes a read request once the current C2HData PDU is consumed, but no mechanism compares the total bytes received against the length requested by the command. A malicious or faulty NVMe controlle...

CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

EUVD-2026-76386

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

PT-2026-90197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-tcp module where the nvme tcp handle r2t function fails to verify the direction of the request associated with a Ready-to-Transfer R2T notification. A malicio...

AlmaLinux 9 : kernel (ALSA-2026:64808)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64808 advisory. kernel: can: bcm: add locking for bcmop runtime updates CVE-2025-38004 kernel: iouring/poll: fix signed comparison in iopollgetownership CVE-2026-52933...

CVE-2026-89482: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in writezeroes processing" established that blkrqpayloadbytes must not be read without first checking...

PT-2026-96383

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme setup discard always maps sizeofstruct nvme dsm range NVME DSM MAX RANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number...

PT-2026-90196

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-tcp module where the nvme tcp recv data function completes a request once the current C2HData PDU is consumed without verifying if the total bytes received...

CVE-2026-89480: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

PT-2026-96500

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme tcp recv data completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for:...

CVE-2026-89483: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...