Executive brief
The Linux kernel's NVMe over TCP target implementation contains a flaw that allows unauthenticated remote attackers to send unsolicited data transfer PDUs before the target has requested them. This can cause command completions to be processed multiple times, leading to kernel crashes (with certain configurations) or system hangs that freeze the NVMe processing subsystem, causing denial of service and disrupting storage operations.
Technical details
The nvmet_tcp_handle_h2c_data_pdu() function in the Linux kernel's NVMe-oF TCP transport layer fails to validate that an H2CData (Host-to-Controller Data) PDU was actually solicited by an R2T (Ready to Transfer) message before accepting the data. An attacker can exploit this by sending an H2CData PDU for a write command before the target transmits the R2T, causing the command to complete prematurely. When the command fails synchronously, it gets added to the response queue twice, creating a self-referential node in the linked list. This causes either a kernel panic (with CONFIG_DEBUG_LIST enabled) or an infinite loop that wedges the nvmet_tcp workqueue. The attack requires network access to a target with allow_any_host configuration but no authentication. The fix involves tracking whether an R2T has been transmitted via a flag that is checked before accepting H2CData PDUs.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-16: disclosed