Executive brief
The Linux kernel's NVMe-over-TCP driver failed to validate that read commands received the full amount of data requested. A malicious or misconfigured storage controller could return only partial data (e.g., 512 bytes of a 4096-byte read), which would be reported to the application as a complete read containing stale data from memory, leading to data corruption or disclosure of sensitive information.
Technical details
The vulnerability is an incomplete validation flaw in the NVMe-over-TCP host driver (drivers/nvme/host/tcp.c). The nvme_tcp_recv_data() function completes read requests after processing each C2HData PDU without comparing the total bytes received against the command's requested length. A remote NVMe controller can answer a legitimate read with fewer bytes than requested; the kernel marks the read as successful and passes the short buffer (padded with uninitialized page data) to the application. The vulnerability affects REQ_OP_READ operations only. The fix adds a per-request byte counter (data_recvd) and validates that the received byte count matches the requested length before completing successful reads, rejecting short reads with -EPROTO.
Affected products
- Linux Linux kernel Affected by design since introduction of NVMe-over-TCP (v5.0+); patched in subsequent releases
Timeline
- 2026-09-11: disclosed: CVE-2026-89480 published
- 2026-08-11: patched: Fix committed upstream by Keith Busch
- 2026-09-07: patched: Fix backported to stable kernels