{"id":"CVE-2026-89480","title":"nvme-tcp: reject a read that transferred too few bytes","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: reject a read that transferred too few bytes\n\nnvme_tcp_recv_data() completes a request once the current C2HData PDU\nhas been consumed. Nothing compares the to…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-130"],"vendor":"Linux","product":"Linux","affected":["Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < a5c1bb0fb1bab2f24a081339c145870697f6d220","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < aa107e3a68f4af177d60f2d87679e7f67179a36c","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < fca3ebb63e5c82561cd9934365dcc0d068008006","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 99066cf9bba175f610ceb61a35f6fc9fbc33ff65","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 8a02ad98798fd01f51f648c1fdd8f3c9d07195d3","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 832a685efeb5d925ee7d30011d2dbe45f81447a3","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 7fa3f73f6c8ddc5f0425b50fb2a626a782ef7d12","Linux 5.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T19:22:32.814624Z"},"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:47:29.641Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89480","references":[{"url":"https://git.kernel.org/stable/c/a5c1bb0fb1bab2f24a081339c145870697f6d220"},{"url":"https://git.kernel.org/stable/c/aa107e3a68f4af177d60f2d87679e7f67179a36c"},{"url":"https://git.kernel.org/stable/c/fca3ebb63e5c82561cd9934365dcc0d068008006"},{"url":"https://git.kernel.org/stable/c/99066cf9bba175f610ceb61a35f6fc9fbc33ff65"},{"url":"https://git.kernel.org/stable/c/8a02ad98798fd01f51f648c1fdd8f3c9d07195d3"},{"url":"https://git.kernel.org/stable/c/832a685efeb5d925ee7d30011d2dbe45f81447a3"},{"url":"https://git.kernel.org/stable/c/7fa3f73f6c8ddc5f0425b50fb2a626a782ef7d12"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89480.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89480"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532095"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89480"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89480"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89480.mbox"},{"url":"https://access.redhat.com/errata/RHSA-2026:72624"},{"url":"https://access.redhat.com/errata/RHSA-2026:71329"},{"url":"https://access.redhat.com/errata/RHSA-2026:71330"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00415,"epssPercentile":0.35649,"patched":["enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_nfv_v_8","enterprise_linux_real_time_v_10","enterprise_linux_rt_v_8"],"scores":{"cna":7.5,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.453Z","slug":"CVE-2026-89480","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: reject a read that transferred too few bytes\n\nnvme_tcp_recv_data() completes a request once the current C2HData PDU\nhas been consumed. Nothing compares the total bytes received against\nthe length the command asked for: struct nvme_tcp_request has no\nreceive-side counter, queue->data_remaining is per queue, and\nblk_mq_end_request() completes for blk_rq_bytes(rq) unconditionally\nwith no residual concept anywhere above.\n\nA controller can therefore answer a 4096-byte read with 512 bytes and\nhave it reported as a complete read; user space then gets 4096 bytes of\nwhich 3584 are whatever was already in the page. I reproduced that with\na test target.\n\nCount the bytes received and refuse to complete a successful read whose\ncount does not match, at the two NVME_TCP_F_DATA_SUCCESS paths and in\nnvme_tcp_process_nvme_cqe(). The success test shifts req->status right\nby one, because the driver keeps the wire value there and shifts it on\ncompletion, so the check must see what the completion path will see.\nOnly REQ_OP_READ is checked, because there the length comes from the\nsectors the request covers; a passthrough command is built by its\nsubmitter, which picks both command and buffer, so the kernel has\nnothing to compare against.\n\n## Affected\n\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < a5c1bb0fb1bab2f24a081339c145870697f6d220`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < aa107e3a68f4af177d60f2d87679e7f67179a36c`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < fca3ebb63e5c82561cd9934365dcc0d068008006`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 99066cf9bba175f610ceb61a35f6fc9fbc33ff65`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 8a02ad98798fd01f51f648c1fdd8f3c9d07195d3`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 832a685efeb5d925ee7d30011d2dbe45f81447a3`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 7fa3f73f6c8ddc5f0425b50fb2a626a782ef7d12`\n- `Linux 5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:72624** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72624)\n- **RHSA-2026:71329** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71329)\n- **RHSA-2026:71330** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71330)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-30 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89480.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":223312,"id":"CVE-2026-89480","ts":1792180053341,"field":"cvss","old":"7","new":"7.5"},{"seq":206964,"id":"CVE-2026-89480","ts":1789749722162,"field":"cvss","old":"7.5","new":"7"},{"seq":198023,"id":"CVE-2026-89480","ts":1789384321430,"field":"cvss","old":"7.4","new":"7.5"},{"seq":183528,"id":"CVE-2026-89480","ts":1789356675746,"field":"cvss","old":"7.5","new":"7.4"},{"seq":153260,"id":"CVE-2026-89480","ts":1789285349780,"field":"cvss","old":null,"new":"7.5"},{"seq":153259,"id":"CVE-2026-89480","ts":1789285349780,"field":"severity","old":"none","new":"high"},{"seq":147726,"id":"CVE-2026-89480","ts":1789270212053,"field":"cvss","old":null,"new":"7.4"},{"seq":147725,"id":"CVE-2026-89480","ts":1789270212053,"field":"severity","old":"none","new":"high"},{"seq":109474,"id":"CVE-2026-89480","ts":1789183732055,"field":"cvss","old":null,"new":"7.4"},{"seq":109473,"id":"CVE-2026-89480","ts":1789183732055,"field":"severity","old":"none","new":"high"}]}