Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89969— nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： nvmet-tcp：修复接收超长 PDU 时发生的越界写入 函数首先将 PDU 头部读取到固定大小为 128 字节的 联合体中，随后计算剩余载荷长度： 接着，它从 开始读取相应数量的额外字节，但从未将结果与 进行比较以限制其范围。 结构体本身恰好为 128 字节，与联合体大小一致。一旦协商了头部摘要（ ），第二个 ICReq 虽然通过了 的检查，但会得出 ，因此向 128 字节缓冲区写入了第 8 到第 132 字节——超出了缓冲区末尾 4 个字节，覆盖了 和 。这些字节

CVSS 9.8 · Critical EPSS 0.69% · P52

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 872d26a391da92ed8f0c0f5cb5fef428067b7f30< a3f0bcfbaf3312a5754d1ce020a07d394669eb25 affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30< 4f84d42c53c49557fb1ef285c683b0a81b576c74 affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30< 58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6 affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30< cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30< 3a385e0c39efbe34db8edd95900c123113ae3450 affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30< dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6 affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30< d95d342bc0ea82dc79e6362b2f1f997431750e4c affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30< 14cc5a7e77731497d5bea70f3bb05df7eda982e4 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89969

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining payload length as queue->left = hdr->hlen - queue->offset + hdgst; and reads that many more bytes into &queue->pdu + queue->offset, without ever bounding the result against sizeof(queue->pdu). A struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the union. Once a header digest has been negotiated (hdgst = 4), a second ICReq passes the hlen == nvmet_tcp_pdu_size() check but yields queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the 128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and queue->data_digest. Those bytes are attacker-controlled (an ICReq carries no digest), and the duplicate ICReq is only rejected later, after the overflow. A remote unauthenticated host can thus corrupt kernel memory adjacent to the receive buffer. Reject any PDU whose declared length would read past the end of queue->pdu before the second recv.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 872d26a391da92ed8f0c0f5cb5fef428067b7f30 ~ a3f0bcfbaf3312a5754d1ce020a07d394669eb25 -
Linux Linux 5.0 -

II. Public POCs for CVE-2026-89969

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89969

请登录查看更多情报信息。

Other References for CVE-2026-89969 (8)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
CVE-2026-89918 9.3 CRITICAL KVM: arm64: Correctly handle end of VA space TLBI invalidation

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89969

No comments yet

Leave a comment