Executive brief
NVMe-TCP is a storage protocol used by Linux systems to communicate with NVMe controllers over the network. A malicious or compromised NVMe controller can trick the host into sending sensitive kernel memory data by sending requests for read commands when it should only be sending requests for write commands. This could expose confidential information including kernel data structures to an attacker with network access to the storage controller.
Technical details
The vulnerability exists in the nvme_tcp_handle_r2t() function in drivers/nvme/host/tcp.c, which fails to validate the direction (read vs. write) of the I/O request before processing a Ready-To-Transfer (R2T) message from a controller. An attacker controlling an NVMe controller can send an R2T for a READ command, causing nvme_tcp_setup_h2c_data_pdu() and nvme_tcp_try_send_data() to send the read buffer contents back to the controller. This read buffer is meant for storing received data, so it contains uninitialized kernel memory including stale page pointers. The fix adds a direction check that rejects R2T messages for non-write commands with a protocol error. Network access to the NVMe controller is required; no user interaction is needed.
Affected products
- Linux Linux kernel including stable branches from linux-5.4.y through linux-6.9.y and others
Timeline
- 2026-09-11: disclosed: Vulnerability disclosed and published on NVD
- 2026-09-07: patched: Fix committed to stable kernel branches by Greg Kroah-Hartman
- 2026-07-29: other: Fix originally authored and dated by Yehyeong Lee