CVE-2026-89481

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

CVE-2026-89482

A flaw was found in the nvme-tcp module of the Linux kernel. This vulnerability arises from improper handling of C2HData for REQOPWRITEZEROES commands, where the system fails to adequately validate the data length. A remote attacker could exploit this by sending specially crafted C2HData, leading...

CVE-2026-89480

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

CVE-2026-89480

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89482

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in writezeroes processing" established that blkrqpayloadbytes must not be read without first checking...

CVE-2026-89481

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

EUVD-2026-76388

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in writezeroes processing" established that blkrqpayloadbytes must not be read without first checking...

CVE-2026-89482 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in writezeroes processing" established that blkrqpayloadbytes must not be read without first checking...

CVE-2026-89482

CVE-2026-89482 affects the nvme-tcp driver in the Linux kernel . The root cause is a gap in the receive-side gate: it checks blk_rq_payload_bytes() but not req->data_len. For REQ_OP_WRITE_ZEROES operations, no physical segments exist yet blk_rq_bytes() is non-zero, so req->iter retains a st...

EUVD-2026-76387

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89481

CVE-2026-89481 affects the nvme-tcp driver in the Linux kernel . The function nvme_tcp_handle_r2t() fails to verify the direction of the NVMe request when processing a Ready to Transfer (R2T) message. A malicious NVMe controller can send an R2T referencing a READ command, causing the host to tran...

CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89480

CVE-2026-89480 affects the nvme-tcp driver in the Linux kernel . The root cause is that nvme_tcp_recv_data() completes a read request once the current C2HData PDU is consumed, without comparing the total bytes received against the length the command requested. No receive-side counter exists in st...

EUVD-2026-76386

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

PT-2026-90198

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk rq payload bytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in write zeroes processing" established that blk rq payload bytes must not be read without first checking blk r...

PT-2026-90197

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme tcp handle r2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme...

PT-2026-90196

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme tcp recv data completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for:...

CVE-2026-80862

This Linux kernel vulnerability affects the nvme-tcp subsystem. The page_frag_cache is used to preallocate PDU buffers for preallocated block device requests, but since block devices are created in parallel threads, the cache is accessed in a thread-unsafe manner. This leads to incorrect refcount...

EUVD-2026-71312

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of pagefragcache nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe...