CVE-2026-89482

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

Commit 25e5cb780e62 ("nvme-tcp: fix possible crash in write_zeroes

processing") established that blk_rq_payload_bytes() must not be read

without first checking blk_rq_nr_phys_segments(), and recorded the

result in nvme_tcp_setup_cmd_pdu() as req->data_len. The receive side

was left as it was.

The two differ for REQ_OP_WRITE_ZEROES, which has no physical segments

but a non-zero blk_rq_bytes(), so setup leaves req->iter untouched

while the receive gate lets a C2HData through and nvme_tcp_recv_data()

copies into whatever the previous command on that tag left there. The

driver-private area is zeroed only when the tag set is allocated.

Reproduced with a test target that leaves a residual iterator on a tag

and then sends a C2HData for a WRITE_ZEROES command on the same tag:

BUG: KASAN: wild-memory-access in _copy_to_iter+0x642/0x1330

Write of size 512

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References