CVE-2026-89969

CVE-2026-89969 is a critical out-of-bounds write in the Linux kernel's NVMe over TCP target (nvmet-tcp) module. The function nvmet_tcp_try_recv_pdu() reads PDU data into a fixed 128-byte buffer without bounding the payload length against the buffer size. When a header digest has been negotiated a...

CVE-2026-89969 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmettcptryrecvpdu reads a PDU header into the fixed 128-byte queue-pdu union, then computes the remaining payload length as queue-left = hdr-hlen - queue-offset ...