EUVD-2026-76387

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89481

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89481

CVE-2026-89481 affects the Linux kernel's NVMe over TCP (nvme-tcp) component. The root cause is that nvme_tcp_handle_r2t() does not validate the direction of the request a Ready to Transfer (R2T) refers to. A malicious NVMe controller can send an R2T for a READ command; the host then sends the co...

CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

EUVD-2026-76386

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89480

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89480

CVE-2026-89480 affects the NVMe-TCP driver in the Linux kernel. The function nvme_tcp_recv_data() completes a read request once the current C2HData PDU is consumed, but no mechanism compares the total bytes received against the length requested by the command. A malicious or faulty NVMe controlle...

PT-2026-96500

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme tcp recv data completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for:...

PT-2026-96357

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk rq payload bytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in write zeroes processing" established that blk rq payload bytes must not be read without first checking blk r...

CVE-2026-89481: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

PT-2026-96523

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme tcp handle r2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme...

CVE-2026-89480: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

PT-2026-90198

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the nvme-tcp driver where the system incorrectly accepts C2HData based solely on the blk rq payload bytes function. For REQ OP WRITE ZEROES operations, which lack physical...

PT-2026-90196

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-tcp module where the nvme tcp recv data function completes a request once the current C2HData PDU is consumed without verifying if the total bytes received...

PT-2026-90197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-tcp module where the nvme tcp handle r2t function fails to verify the direction of the request associated with a Ready-to-Transfer R2T notification. A malicio...