CVE-2026-89969

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte

queue->pdu union, then computes the remaining payload length as

queue->left = hdr->hlen - queue->offset + hdgst;

and reads that many more bytes into &queue->pdu + queue->offset, without

ever bounding the result against sizeof(queue->pdu).

A struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the

union. Once a header digest has been negotiated (hdgst = 4), a second

ICReq passes the hlen == nvmet_tcp_pdu_size() check but yields

queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the

128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and

queue->data_digest. Those bytes are attacker-controlled (an ICReq

carries no digest), and the duplicate ICReq is only rejected later,

after the overflow. A remote unauthenticated host can thus corrupt

kernel

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References