From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B97A4EBAD2 for ; Wed, 16 Sep 2026 10:41:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555323; cv=none; b=N3sYziFgpqwVv+fX5yRPQktuMhz24wt2j4FYLR+Phhqk7ylOyYARmBa6AC68dek4bYPEq725lrB/sJmo5lnQZ83TiM2iSYohHqHWUnJnsEP+IgEW4Xk8PbGSAvDw8V4X8shFF4GnGvNq04JNwpjIFeiZd4ClfIMWPWr+SX+Srvk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555323; c=relaxed/simple; bh=Kz6N60ZPhVJV+13lxpYljuT72BYOjO4edfwGzItgrUA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=EuVhoQaRVRE3/5v8mO5nYX5fgbRofWARtldSFBzW/0MI6X3mljdb30aSheqj3B+fy8tJlZGLuDdVqw1iQqn0rXy5b3A0/d04qs8SDtaiwr5w+DbNkBH/wifgo06XDMA5lSRJ1LJi0yqu2fzRqnUCgzApPdYlV3L5bXra7c21Su0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=otlA/w+s; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="otlA/w+s" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B968D1F000FF; Wed, 16 Sep 2026 10:41:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789555299; bh=+FnM7V/2UNwl7KD9sUYYD0nk0l2MJuZWWbhY7Khg0nA=; h=From:To:Cc:Subject:Date:Reply-To; b=otlA/w+sm4AKFKtMnj0XDpOhzHT5qeW5TKWoV5nGbAkWgrqNXqrM5oCCXDwVHIqnj QRFNa2xWBnGYreDMY/ydV7lev3JnDCByieVApSuiy6wpUxyQt6S7V3nu52FfYZ/yZZ Vq+wWl7+ILBn6H9l+FLJxYquOivjS9I7t1C5RKyU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89969: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU Date: Wed, 16 Sep 2026 11:31:39 +0100 Message-ID: <2026091653-CVE-2026-89969-e536@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4166; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Gfc+7/JhcQ/Pz2cT/rFKTvwJ4Ga+CzjTcwqGL/LuP6I=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8hfKNkVLck0LvLq5I6HB99P1Noa+WrHnbesW/C06x 5kr/HduRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAExE149hwfk3XYdLo8tuXF6y 9kZbRZb3ccVL+xnmx4RWL2XSajxY/GnXrjO9MtOn9SgrAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining payload length as queue->left = hdr->hlen - queue->offset + hdgst; and reads that many more bytes into &queue->pdu + queue->offset, without ever bounding the result against sizeof(queue->pdu). A struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the union. Once a header digest has been negotiated (hdgst = 4), a second ICReq passes the hlen == nvmet_tcp_pdu_size() check but yields queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the 128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and queue->data_digest. Those bytes are attacker-controlled (an ICReq carries no digest), and the duplicate ICReq is only rejected later, after the overflow. A remote unauthenticated host can thus corrupt kernel memory adjacent to the receive buffer. Reject any PDU whose declared length would read past the end of queue->pdu before the second recv. The Linux kernel CVE team has assigned CVE-2026-89969 to this issue. Affected and fixed versions =========================== Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 5.10.270 with commit a3f0bcfbaf3312a5754d1ce020a07d394669eb25 Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 5.15.221 with commit 4f84d42c53c49557fb1ef285c683b0a81b576c74 Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 6.1.188 with commit 58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6 Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 6.6.157 with commit cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 6.12.110 with commit 3a385e0c39efbe34db8edd95900c123113ae3450 Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 6.18.51 with commit dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6 Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 7.2.5 with commit d95d342bc0ea82dc79e6362b2f1f997431750e4c Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 7.3-rc2 with commit 14cc5a7e77731497d5bea70f3bb05df7eda982e4 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89969 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/nvme/target/tcp.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/a3f0bcfbaf3312a5754d1ce020a07d394669eb25 https://git.kernel.org/stable/c/4f84d42c53c49557fb1ef285c683b0a81b576c74 https://git.kernel.org/stable/c/58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6 https://git.kernel.org/stable/c/cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca https://git.kernel.org/stable/c/3a385e0c39efbe34db8edd95900c123113ae3450 https://git.kernel.org/stable/c/dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6 https://git.kernel.org/stable/c/d95d342bc0ea82dc79e6362b2f1f997431750e4c https://git.kernel.org/stable/c/14cc5a7e77731497d5bea70f3bb05df7eda982e4