{"id":"CVE-2026-89481","title":"nvme-tcp: fix host memory disclosure on R2T for a read command","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix host memory disclosure on R2T for a read command\n\nnvme_tcp_handle_r2t() does not check the direction of the request the\nR2T refers to. A malicious control…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-201"],"vendor":"Linux","product":"Linux","affected":["Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 49a4dcf57608ebf6432dbcb203ed25e7ed581445","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < bc4013c7cce58d46f792c8c87bc8c8318a70190e","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < a4c3c7310156493797c920b10d8648c07aa05403","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 3b3d27670c0c890ba7cf1bc3614cab61bde6d25c","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 3a0b05145053a5fad1a2ddb4e4d87b07385e63e5","Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 6efbc52237facda35d2d874fe1765bb4839275d8","Linux 5.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T19:22:35.614121Z"},"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:47:30.916Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89481","references":[{"url":"https://git.kernel.org/stable/c/49a4dcf57608ebf6432dbcb203ed25e7ed581445"},{"url":"https://git.kernel.org/stable/c/bc4013c7cce58d46f792c8c87bc8c8318a70190e"},{"url":"https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403"},{"url":"https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c"},{"url":"https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5"},{"url":"https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89481.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89481"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532184"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89481"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89481"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89481.mbox"},{"url":"https://access.redhat.com/errata/RHSA-2026:71602"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00413,"epssPercentile":0.35387,"patched":["enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_v_10"],"scores":{"cna":7.5,"vendor":7.1},"ingestedAt":"2026-09-14T15:23:07.453Z","slug":"CVE-2026-89481","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix host memory disclosure on R2T for a read command\n\nnvme_tcp_handle_r2t() does not check the direction of the request the\nR2T refers to. A malicious controller can send an R2T for a READ and\nthe host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the\nH2CData header and nvme_tcp_try_send_data() sends the request's data\nbuffer. That buffer is the READ destination, so its contents go to the\ncontroller.\n\nThe command then completes normally and nothing is logged.\n\nAgainst a test controller that answers every READ with an R2T, a 4096\nbyte buffered read returned all 4096 bytes, split over two R2Ts. The\npages contained stale kernel data, including an array of struct page\npointers.\n\nReject an R2T for a request that is not a write.\n\n## Affected\n\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 49a4dcf57608ebf6432dbcb203ed25e7ed581445`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < bc4013c7cce58d46f792c8c87bc8c8318a70190e`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < a4c3c7310156493797c920b10d8648c07aa05403`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 3b3d27670c0c890ba7cf1bc3614cab61bde6d25c`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 3a0b05145053a5fad1a2ddb4e4d87b07385e63e5`\n- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 6efbc52237facda35d2d874fe1765bb4839275d8`\n- `Linux 5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:71602** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71602)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-30 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89481.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":223313,"id":"CVE-2026-89481","ts":1792180053781,"field":"cvss","old":"7.1","new":"7.5"},{"seq":214197,"id":"CVE-2026-89481","ts":1790841356973,"field":"cvss","old":"7","new":"7.1"},{"seq":206960,"id":"CVE-2026-89481","ts":1789749719391,"field":"cvss","old":"7.5","new":"7"},{"seq":198024,"id":"CVE-2026-89481","ts":1789384321439,"field":"cvss","old":"7.4","new":"7.5"},{"seq":183529,"id":"CVE-2026-89481","ts":1789356675755,"field":"cvss","old":"7.5","new":"7.4"},{"seq":153262,"id":"CVE-2026-89481","ts":1789285349788,"field":"cvss","old":null,"new":"7.5"},{"seq":153261,"id":"CVE-2026-89481","ts":1789285349788,"field":"severity","old":"none","new":"high"},{"seq":147616,"id":"CVE-2026-89481","ts":1789270211609,"field":"cvss","old":null,"new":"7.4"},{"seq":147615,"id":"CVE-2026-89481","ts":1789270211609,"field":"severity","old":"none","new":"high"},{"seq":109370,"id":"CVE-2026-89481","ts":1789183731645,"field":"cvss","old":null,"new":"7.4"},{"seq":109369,"id":"CVE-2026-89481","ts":1789183731645,"field":"severity","old":"none","new":"high"}]}