{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89481", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.711Z", "datePublished": "2026-09-11T19:43:36.589Z", "dateUpdated": "2026-09-11T19:43:36.589Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:43:36.589Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix host memory disclosure on R2T for a read command\n\nnvme_tcp_handle_r2t() does not check the direction of the request the\nR2T refers to. A malicious controller can send an R2T for a READ and\nthe host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the\nH2CData header and nvme_tcp_try_send_data() sends the request's data\nbuffer. That buffer is the READ destination, so its contents go to the\ncontroller.\n\nThe command then completes normally and nothing is logged.\n\nAgainst a test controller that answers every READ with an R2T, a 4096\nbyte buffered read returned all 4096 bytes, split over two R2Ts. The\npages contained stale kernel data, including an array of struct page\npointers.\n\nReject an R2T for a request that is not a write."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/tcp.c"], "versions": [{"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "a4c3c7310156493797c920b10d8648c07aa05403", "status": "affected", "versionType": "git"}, {"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "3b3d27670c0c890ba7cf1bc3614cab61bde6d25c", "status": "affected", "versionType": "git"}, {"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "3a0b05145053a5fad1a2ddb4e4d87b07385e63e5", "status": "affected", "versionType": "git"}, {"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "6efbc52237facda35d2d874fe1765bb4839275d8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/tcp.c"], "versions": [{"version": "5.0", "status": "affected"}, {"version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403"}, {"url": "https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c"}, {"url": "https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5"}, {"url": "https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8"}], "title": "nvme-tcp: fix host memory disclosure on R2T for a read command", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a4c3c7310156493797c920b10d8648c07aa05403", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}, {"lessThan": "3b3d27670c0c890ba7cf1bc3614cab61bde6d25c", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}, {"lessThan": "3a0b05145053a5fad1a2ddb4e4d87b07385e63e5", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}, {"lessThan": "6efbc52237facda35d2d874fe1765bb4839275d8", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix host memory disclosure on R2T for a read command\n\nnvme_tcp_handle_r2t() does not check the direction of the request the\nR2T refers to. A malicious controller can send an R2T for a READ and\nthe host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the\nH2CData header and nvme_tcp_try_send_data() sends the request's data\nbuffer. That buffer is the READ destination, so its contents go to the\ncontroller.\n\nThe command then completes normally and nothing is logged.\n\nAgainst a test controller that answers every READ with an R2T, a 4096\nbyte buffered read returned all 4096 bytes, split over two R2Ts. The\npages contained stale kernel data, including an array of struct page\npointers.\n\nReject an R2T for a request that is not a write."}], "id": "CVE-2026-89481", "lastModified": "2026-09-11T20:19:29.600", "metrics": {}, "published": "2026-09-11T20:19:29.600", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel (nvme-tcp): Host memory disclosure", "id": "2532184", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532184"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) over TCP (nvme-tcp) component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer (R2T) command for a read request. The host system, failing to properly validate the request direction, will then send the contents of its read destination buffer to the controller. This can lead to the disclosure of stale kernel memory data, potentially revealing sensitive information."], "name": "CVE-2026-89481", "public_date": "2026-09-11T19:43:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89481\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89481\nhttps://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5\nhttps://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c\nhttps://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8\nhttps://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403"], "threat_severity": "Moderate"}

{"created": "2026-09-12T02:45:06.766197+00:00", "updated": "2026-09-12T02:45:06.766203+00:00", "vendors": [], "weaknesses": ["CWE-201"]}