From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B68A355C1DA for ; Fri, 11 Sep 2026 19:53:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156450; cv=none; b=dZojdfkj0K03wHW5KhEtzsfK9ksW2H3NJFteqqvWqDC1QQazV/l1NLfNaqYeG9ykUgU4GpBnVsf4HCpbsx3l0Tzp2FYe/hv6BslDeD4Ro7O33kXDaO103iF6LgqIWnE0W/VMedWW0qgmH1IdWlGBSG70hxyTSZ4aT783l1YSah4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156450; c=relaxed/simple; bh=q2KaAbZ0oZGObBvbIM/3wm/qJPspDmpFT/Kd+scV1d4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=elKLYqyuNp58j99hi90naWMG9HRx3GHvpF3BJkRKpCwhn4rRwqDXpAoRvo0iNEbDLjCRVxoffNMKoLIay/jYDqWGjnwLPUV8s4m1Ng0kd1tn17iSEHRhR90wbbju4kMwTnMIpVoiE6kH5+aymvctTf+Nm3a899t09OMfgbedZNY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OVYwvyND; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="OVYwvyND" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81B201F000FF; Fri, 11 Sep 2026 19:53:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789156432; bh=3wim7GWITFb3bYzR+nYwokwQSTM1GZOKQiFx07d2cbM=; h=From:To:Cc:Subject:Date:Reply-To; b=OVYwvyNDSOn49toM4bbNxqu09qKAKNU8gVJxk3A0Rmr97zfGuDuZxFNmqtUjIYS9P V7+hsJzQQMz2RDMQQxYIBZsa3TTEtUivghViE2ZuJQ3K6hqrk3DlEQGZKafolNe+fS 7mEIBOv3lZUmi9aDelbQGNN7N0iB+adZEg/w8DXo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command Date: Fri, 11 Sep 2026 21:42:50 +0200 Message-ID: <2026091105-CVE-2026-89481-cf1c@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2925; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=ORU07rcY+OgSa7pfSUzcEVgBJ3HB/VmgPE0jRX1ZgiY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIgObu18rHmlPnulx9v20TcyT9Zf8zEz5pLZZw0z4j fcTq+/SHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCR3ccZFiz4qSrnz98mWS+e 8qsp8HLZnp6V9xjmh4Zw/uAIMmOVfVkncuiKrkXOgWX2AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends the request's data buffer. That buffer is the READ destination, so its contents go to the controller. The command then completes normally and nothing is logged. Against a test controller that answers every READ with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained stale kernel data, including an array of struct page pointers. Reject an R2T for a request that is not a write. The Linux kernel CVE team has assigned CVE-2026-89481 to this issue. Affected and fixed versions =========================== Issue introduced in 5.0 with commit 3f2304f8c6d6ed97849057bd16fee99e434ca796 and fixed in 6.12.109 with commit a4c3c7310156493797c920b10d8648c07aa05403 Issue introduced in 5.0 with commit 3f2304f8c6d6ed97849057bd16fee99e434ca796 and fixed in 6.18.50 with commit 3b3d27670c0c890ba7cf1bc3614cab61bde6d25c Issue introduced in 5.0 with commit 3f2304f8c6d6ed97849057bd16fee99e434ca796 and fixed in 7.2.4 with commit 3a0b05145053a5fad1a2ddb4e4d87b07385e63e5 Issue introduced in 5.0 with commit 3f2304f8c6d6ed97849057bd16fee99e434ca796 and fixed in 7.3-rc1 with commit 6efbc52237facda35d2d874fe1765bb4839275d8 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89481 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/nvme/host/tcp.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403 https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5 https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8