Executive brief
The NVMe over TCP target driver in the Linux kernel contains a buffer overflow vulnerability in its Protocol Data Unit (PDU) processing. An unauthenticated remote attacker can send specially crafted network packets to corrupt adjacent kernel memory, potentially leading to system crash or unauthorized code execution on any system hosting NVMe storage targets.
Technical details
The vulnerability is a heap buffer overflow in the nvmet_tcp_try_recv_pdu() function of the NVMe over TCP target driver (drivers/nvme/target/tcp.c). The function reads a PDU header into a fixed 128-byte union without properly validating the declared payload length. When a header digest is negotiated (hdgst = 4), an attacker can craft an over-length ICReq PDU that passes initial validation but causes the calculated queue->left value to exceed the buffer bounds, writing up to 4 bytes past the end of the 128-byte queue->pdu union into adjacent kernel data structures (queue->hdr_digest and queue->data_digest). This occurs before the duplicate ICReq is rejected, allowing an unauthenticated remote attacker to corrupt kernel memory. The fix adds a bounds check: if (queue->left > sizeof(queue->pdu) - queue->offset) return -EPROTO, rejecting malformed PDUs before the overflow occurs. Patches are available in commit 14cc5a7e77731497d5bea70f3bb05df7eda982e4 (mainline) and 3a385e0c39efbe34db8edd95900c123113ae3450 (stable).
Affected products
- Linux Linux kernel Affected versions prior to patch commit 14cc5a7e77731497d5bea70f3bb05df7eda982e4
Timeline
- 2026-09-16: disclosed: CVE-2026-89969 published
- 2026-09-03: patched: Upstream fix committed (14cc5a7e77731497d5bea70f3bb05df7eda982e4)
- 2026-09-14: patched: Stable tree backport committed (3a385e0c39efbe34db8edd95900c123113ae3450)