HIGH Introduced in 5.0
nvme-tcp R2T Info Leak
CVE-2026-89481
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends the request's data buffer. That buffer is the READ destination, so its contents go to the controller. The command then completes normally and nothing is logged. Against a test controller that answers every READ with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained stale kernel data, including an array of struct page pointers. Reject an R2T for a request that is not a write.
02KernelScan AI Analysis
Risk summary
A malicious or compromised NVMe-oF TCP controller can trick the host kernel into sending the contents of stale kernel memory buffers back over the network by issuing an R2T (Ready to Transfer) for a read command. The host driver fails to verify the command direction before responding, leaking kernel heap data including potentially sensitive pointers. This affects any system using the NVMe over TCP host driver.
Vulnerability analysis
The NVMe over TCP host driver processes Ready-to-Transfer requests from the NVMe controller without checking whether the associated command is a write. A malicious controller can send such a request for a read command, causing the host to transmit the read command's destination buffer contents back to the controller. Since that buffer has not yet been filled with read data, it contains stale kernel memory, potentially including kernel pointers and other sensitive data. The fix adds a direction check that rejects any such request targeting a non-write command. The vulnerability is reachable from the network by any entity that controls or has compromised the NVMe-oF TCP controller, requiring no special privileges on the host.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.0 | 6.1.188 | 49a4dcf57608 |
| 6.12 | 5.0 | 6.12.109 | a4c3c7310156 |
| 6.18 | 5.0 | 6.18.50 | 3b3d27670c0c |
| 6.6 | 5.0 | 6.6.157 | bc4013c7cce5 |
| 7.2 | 5.0 | 7.2.4 | 3a0b05145053 |
| mainline | 5.0 | 7.3 | 6efbc52237fa |
| cip/6.1 | 5.0 | 6.1.189-cip61 | 49a4dcf57608 |
| cip/6.1-rt | 5.0 | 6.1.189-cip61-rt32 | 49a4dcf57608 |
| cip/6.12 | 5.0 | 6.12.111-cip32 | a4c3c7310156 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |