Executive brief
A vulnerability was identified in the Linux kernel's NVMe-over-TCP (nvmet-tcp) target driver. This component allows computers to access storage over a network using the NVMe protocol. An error in how the system handles malformed network data could lead to the system attempting to process information using uninitialized memory, potentially causing a system crash or unpredictable behavior.
Technical details
A vulnerability exists in the Linux kernel's nvmet-tcp driver where the function 'nvmet_tcp_build_pdu_iovec()' fails to return error codes to its callers. When this function encounters an out-of-bounds PDU length or offset, it triggers a fatal error and returns early without initializing 'cmd->recv_msg.msg_iter'. Callers like 'nvmet_tcp_handle_h2c_data_pdu()' are unaware of this failure and proceed to set the queue state to 'NVMET_TCP_RECV_DATA'. This causes the socket receiving loop to attempt to read incoming network data into an uninitialized iterator, which can lead to kernel instability or memory corruption. The fix involves changing the function signature to return an integer and ensuring callers check for and handle these errors.
Affected products
- Linux Linux Kernel 5.10.250 to 5.11; 5.15.200 to 5.16; 6.1.163 to 6.1.175; 6.6.124 to 6.6.141; 6.12.70 to 6.12.91; 6.18.10 to 6.18.33
Timeline
- 2026-06-24: disclosed: CVE published
- 2026-05-23: patched: Initial patch committed to stable tree
References
- https://git.kernel.org/stable/c/046fa5c72d15cd8e2d592e275697ea399d8f76b0
- https://git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453c
- https://git.kernel.org/stable/c/c2a11441538bdbbc5aa003f190995eba93a89b88
- https://git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3
- https://git.kernel.org/stable/c/ea8e356acb165cb1fd75537a52e1f66e5e76c538
- https://git.kernel.org/stable/c/f9204a2b78dd18374d3bcf9bf93d9021ce22de1b