CVE-2026-89969: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

CVE-2026-89969: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte
queue->pdu union, then computes the remaining payload length as

	queue->left = hdr->hlen - queue->offset + hdgst;

and reads that many more bytes into &queue->pdu + queue->offset, without
ever bounding the result against sizeof(queue->pdu).

A struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the
union. Once a header digest has been negotiated (hdgst = 4), a second
ICReq passes the hlen == nvmet_tcp_pdu_size() check but yields
queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the
128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and
queue->data_digest. Those bytes are attacker-controlled (an ICReq
carries no digest), and the duplicate ICReq is only rejected later,
after the overflow. A remote unauthenticated host can thus corrupt
kernel memory adjacent to the receive buffer.

Reject any PDU whose declared length would read past the end of
queue->pdu before the second recv.

The Linux kernel CVE team has assigned CVE-2026-89969 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 5.10.270 with commit a3f0bcfbaf3312a5754d1ce020a07d394669eb25
	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 5.15.221 with commit 4f84d42c53c49557fb1ef285c683b0a81b576c74
	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 6.1.188 with commit 58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6
	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 6.6.157 with commit cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca
	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 6.12.110 with commit 3a385e0c39efbe34db8edd95900c123113ae3450
	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 6.18.51 with commit dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6
	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 7.2.5 with commit d95d342bc0ea82dc79e6362b2f1f997431750e4c
	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 7.3-rc2 with commit 14cc5a7e77731497d5bea70f3bb05df7eda982e4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89969
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/nvme/target/tcp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a3f0bcfbaf3312a5754d1ce020a07d394669eb25
	https://git.kernel.org/stable/c/4f84d42c53c49557fb1ef285c683b0a81b576c74
	https://git.kernel.org/stable/c/58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6
	https://git.kernel.org/stable/c/cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca
	https://git.kernel.org/stable/c/3a385e0c39efbe34db8edd95900c123113ae3450
	https://git.kernel.org/stable/c/dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6
	https://git.kernel.org/stable/c/d95d342bc0ea82dc79e6362b2f1f997431750e4c
	https://git.kernel.org/stable/c/14cc5a7e77731497d5bea70f3bb05df7eda982e4