CVE-2026-89481

CVE-2026-89481 affects the nvme-tcp driver in the Linux kernel . The function nvme_tcp_handle_r2t() fails to verify the direction of the NVMe request when processing a Ready to Transfer (R2T) message. A malicious NVMe controller can send an R2T referencing a READ command, causing the host to tran...