CVE-2026-89973— nvme-tcp: check the data direction of a C2HData PDU
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到解决： nvme-tcp：检查 C2HData PDU 的数据方向 函数通过命令 ID 查找对应的请求，并检查该请求是否携带有效载荷（payload），但它并没有检查该命令是否请求了数据读取。因此，如果一个控制器在响应写命令时返回了 C2HData（Controller to Host Data），代码会执行到 ，其中 函数遇到 并返回 0。接收路径随后将此解释为 错误，并触发控制器重置。 由于没有实际复制数据，因此这并不属于内存损坏。然而，控制器可以随意触发的内核警告（ker
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 3f2304f8c6d6ed97849057bd16fee99e434ca796< df74950ba6008655d4a977d17df7faf4b6e52b74 |
affected |
3f2304f8c6d6ed97849057bd16fee99e434ca796< 980d990f3c0560d7dfbfbf14699651fdf02f26ee |
affected | ||
3f2304f8c6d6ed97849057bd16fee99e434ca796< 5b115d932f6e769ac80783fb18edd21b0aed256e |
affected | ||
3f2304f8c6d6ed97849057bd16fee99e434ca796< 0673a2affe45ca76b60de31a83c67b1e60f81bde |
affected | ||
3f2304f8c6d6ed97849057bd16fee99e434ca796< 80d56202fbdff8906be6954b2776e5c14a4026f2 |
affected | ||
3f2304f8c6d6ed97849057bd16fee99e434ca796< b4af7999a998787d5eb6facb5a333e04a4f1d2d9 |
affected | ||
3f2304f8c6d6ed97849057bd16fee99e434ca796< a0c389b8a495bda1eb719d2503853c924b7a8355 |
affected | ||
3f2304f8c6d6ed97849057bd16fee99e434ca796< f83af377c148f6ad94b41c0e8313f12adf45e1c1 |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89973
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
nvme-tcp: check the data direction of a C2HData PDU
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: check the data direction of a C2HData PDU
nvme_tcp_handle_c2h_data() finds the request by command id and checks
that it has a payload, but it does not check that the command asked for
data to be read. A controller that answers a write command with C2HData
therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits
WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that
into -EFAULT and resets the controller.
No data is copied, so this is not memory corruption. What a controller
gets is a kernel warning it can raise at will, which is fatal on a host
booted with panic_on_warn.
The send path already knows the direction - it consults rq_data_dir()
when it builds a command - and nvme_tcp_handle_r2t() checks the length
and the offset of the request it names. The C2HData path does not check
the direction at all.
Reject a C2HData PDU whose command is not a read. Rejecting it fails
the command and resets the controller, as the neighbouring check in this
function does; what goes away is the warning.
[ 6.885580] ------------[ cut here ]------------
[ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71
[ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy)
[ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work
[ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330
[ 6.903739] Call Trace:
[ 6.904085] <TASK>
[ 6.909254] __skb_datagram_iter+0x433/0x820
[ 6.911026] skb_copy_datagram_iter+0x37/0x120
[ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320
[ 6.913378] __tcp_read_sock+0x1ab/0x810
[ 6.915788] nvme_tcp_try_recv+0x152/0x1e0
[ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0
[ 6.926906] </TASK>
[ 6.927226] ---[ end trace 0000000000000000 ]---
[ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data
[ 6.928709] nvme nvme0: receive failed: -14
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-89973
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89973
请登录查看更多情报信息。
Other References for CVE-2026-89973 (8)
Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total
| CVE-2026-90048 | 9.8 CRITICAL | fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() |
| CVE-2026-90012 | 9.8 CRITICAL | spi: Fix DMA mapping ownership on partial map failure |
| CVE-2026-89970 | 9.8 CRITICAL | nvmet-auth: Synchronize timeout work during SQ teardown |
| CVE-2026-89857 | 9.8 CRITICAL | scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject |
| CVE-2026-89969 | 9.8 CRITICAL | nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU |
| CVE-2026-89847 | 9.8 CRITICAL | scsi: qla2xxx: Avoid double completion in async IOCB timeout |
| CVE-2026-89972 | 9.8 CRITICAL | nvme: add missing SRCU grace period in error path |
| CVE-2026-89990 | 9.8 CRITICAL | ceph: lock mutex in ceph_mds_check_access() |
| CVE-2026-90036 | 9.8 CRITICAL | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-90038 | 9.8 CRITICAL | NFSD: Prevent client use-after-free during export state revocation |
| CVE-2026-90037 | 9.8 CRITICAL | NFSD: Prevent client use-after-free during close_lru reaping |
| CVE-2026-89788 | 9.8 CRITICAL | ksmbd: fix tree connection use-after-free in smb2_tree_connect() |
| CVE-2026-89783 | 9.8 CRITICAL | xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full |
| CVE-2026-90042 | 9.8 CRITICAL | ceph: properly decrypt filenames in vmalloc() buffers |
| CVE-2026-89778 | 9.8 CRITICAL | isofs: fix out-of-bounds page array access on empty zisofs block |
| CVE-2026-89915 | 9.3 CRITICAL | KVM: arm64: Remove VM-wide VNCR mapping counter |
| CVE-2026-90049 | 9.3 CRITICAL | net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() |
| CVE-2026-89775 | 9.3 CRITICAL | KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation |
| CVE-2026-89916 | 9.3 CRITICAL | KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry |
| CVE-2026-89930 | 9.3 CRITICAL | KVM: nVMX: Service local TLB flushes on failed nested VM-Enter |
Showing top 20 of 276 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2026-89973
No comments yet