From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 40FB33101BF for ; Wed, 24 Jun 2026 16:33:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782318830; cv=none; b=fngXsOIgzk9UExv1UXSDpb/I1bFlRP2EFLN1etOx+pLBXGM1UegQmWF8OvXxe2uXrbvO1Oddh69OyRegQ+CS2dVz4tQ/z3SK9HzNyyQQJhMjaDTmCtwCbtVnJIbOEPMaJM9YY0BZj9QzdJBbiPJzRKAobIdNyGDZEoZBVUqLDP0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782318830; c=relaxed/simple; bh=Tpru4EK73CjUls+UfrcJ73tIUEJOXcZLbSX5mhm5ObY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ozKW6OWTSuT8toV22n85rMK1SMDPISpDMziKOPalOPaRVi82SVoIKu4DoIOK1RXZPI/HIPp6HMQPc1HdWpVd/WLXL1w2gNxxTnpntnfSrs8OIkwpqWFt/df1Iasgyg7SdYL8n4KXxNgRpYjL9hY1LzokxeCQ0Iyx8tuwTwf1qQ8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kybDVAqp; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="kybDVAqp" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D18A1F000E9; Wed, 24 Jun 2026 16:33:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1782318828; bh=ucTu69N39nzbT0ub0j7yXo52aAv+6eEuSdFyLkut9BU=; h=From:To:Cc:Subject:Date:Reply-To; b=kybDVAqpca3J7rL0NfP/I9kCqHPFLmYuJ2oam4RkDgWS2GtLChBRkgufut/aRlXch y7yYsOPaIsebSX2n16EsgLswz98pRNGzirjJ4hJtePeYIBDFyMKYPvexrb4ctLXSOO uFn0vietMh9+Ui75BMP1InG3mL7uHm595UZxr2Zg= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-52989: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Date: Wed, 24 Jun 2026 17:30:13 +0100 Message-ID: <2026062444-CVE-2026-52989-beb8@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3534; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=gUGbd7hmw/8vAs6BScpsxaqDj7sYdLCQqcWOxlVfx8o=; b=owGbwMvMwCRo6H6F97bub03G02pJDFk2rD/830t7T263spxxLKXiyqtfOr8nrwuIrjQTuXrIK /CpfnhnRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEyEwYNhwaJAW4drt3yqzpgv mT8xVFCPPW3xSYYFa1lZCvrEH9vOfWnfun1euH6U8GwJAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers. The Linux kernel CVE team has assigned CVE-2026-52989 to this issue. Affected and fixed versions =========================== Issue introduced in 6.1.163 with commit 1385be357e8acd09b36e026567f3a9d5c61139de and fixed in 6.1.175 with commit 3df42a854686fa06484e37ac1a3931c8e3e3453c Issue introduced in 6.6.124 with commit dca1a6ba0da9f472ef040525fab10fd9956db59f and fixed in 6.6.141 with commit d7c8f95f599b3b38a717d2e771c3f8c174f657c3 Issue introduced in 6.12.70 with commit 19672ae68d52ff75347ebe2420dde1b07adca09f and fixed in 6.12.91 with commit f9204a2b78dd18374d3bcf9bf93d9021ce22de1b Issue introduced in 6.18.10 with commit ab200d71553bdcf4de554a5985b05b2dd606bc57 and fixed in 6.18.33 with commit c2a11441538bdbbc5aa003f190995eba93a89b88 Issue introduced in 6.19 with commit 52a0a98549344ca20ad81a4176d68d28e3c05a5c and fixed in 7.0.10 with commit 046fa5c72d15cd8e2d592e275697ea399d8f76b0 Issue introduced in 6.19 with commit 52a0a98549344ca20ad81a4176d68d28e3c05a5c and fixed in 7.1 with commit ea8e356acb165cb1fd75537a52e1f66e5e76c538 Issue introduced in 5.10.250 with commit 043b4307a99f902697349128fde93b2ddde4686c Issue introduced in 5.15.200 with commit 42afe8ed8ad2de9c19457156244ef3e1eca94b5d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-52989 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/nvme/target/tcp.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453c https://git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3 https://git.kernel.org/stable/c/f9204a2b78dd18374d3bcf9bf93d9021ce22de1b https://git.kernel.org/stable/c/c2a11441538bdbbc5aa003f190995eba93a89b88 https://git.kernel.org/stable/c/046fa5c72d15cd8e2d592e275697ea399d8f76b0 https://git.kernel.org/stable/c/ea8e356acb165cb1fd75537a52e1f66e5e76c538