CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command

CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix host memory disclosure on R2T for a read command

nvme_tcp_handle_r2t() does not check the direction of the request the
R2T refers to. A malicious controller can send an R2T for a READ and
the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the
H2CData header and nvme_tcp_try_send_data() sends the request's data
buffer. That buffer is the READ destination, so its contents go to the
controller.

The command then completes normally and nothing is logged.

Against a test controller that answers every READ with an R2T, a 4096
byte buffered read returned all 4096 bytes, split over two R2Ts. The
pages contained stale kernel data, including an array of struct page
pointers.

Reject an R2T for a request that is not a write.

The Linux kernel CVE team has assigned CVE-2026-89481 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.0 with commit 3f2304f8c6d6ed97849057bd16fee99e434ca796 and fixed in 6.12.109 with commit a4c3c7310156493797c920b10d8648c07aa05403
	Issue introduced in 5.0 with commit 3f2304f8c6d6ed97849057bd16fee99e434ca796 and fixed in 6.18.50 with commit 3b3d27670c0c890ba7cf1bc3614cab61bde6d25c
	Issue introduced in 5.0 with commit 3f2304f8c6d6ed97849057bd16fee99e434ca796 and fixed in 7.2.4 with commit 3a0b05145053a5fad1a2ddb4e4d87b07385e63e5
	Issue introduced in 5.0 with commit 3f2304f8c6d6ed97849057bd16fee99e434ca796 and fixed in 7.3-rc1 with commit 6efbc52237facda35d2d874fe1765bb4839275d8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89481
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/nvme/host/tcp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403
	https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c
	https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5
	https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8