CVE-2026-89973

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: check the data direction of a C2HData PDU

nvme_tcp_handle_c2h_data() finds the request by command id and checks

that it has a payload, but it does not check that the command asked for

data to be read. A controller that answers a write command with C2HData

therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits

WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that

into -EFAULT and resets the controller.

No data is copied, so this is not memory corruption. What a controller

gets is a kernel warning it can raise at will, which is fatal on a host

booted with panic_on_warn.

The send path already knows the direction - it consults rq_data_dir()

when it builds a command - and nvme_tcp_handle_r2t() checks the length

and the offset of the request it names. The C2HData path does not check

the direction at all.

Reject a C2HData PDU whose command is not a read. Rejecting it fails

the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References