---
id: CVE-2026-89481
title: 'nvme-tcp: fix host memory disclosure on R2T for a read command'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-tcp: fix host memory disclosure on R2T for a read command

  nvme_tcp_handle_r2t() does not check the direction of the request the
  R2T refers to. A malicious control…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-201
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 <
    49a4dcf57608ebf6432dbcb203ed25e7ed581445
  - >-
    Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 <
    bc4013c7cce58d46f792c8c87bc8c8318a70190e
  - >-
    Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 <
    a4c3c7310156493797c920b10d8648c07aa05403
  - >-
    Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 <
    3b3d27670c0c890ba7cf1bc3614cab61bde6d25c
  - >-
    Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 <
    3a0b05145053a5fad1a2ddb4e4d87b07385e63e5
  - >-
    Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 <
    6efbc52237facda35d2d874fe1765bb4839275d8
  - Linux 5.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T19:22:35.614121Z'
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:47:30.916Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89481'
references:
  - url: 'https://git.kernel.org/stable/c/49a4dcf57608ebf6432dbcb203ed25e7ed581445'
  - url: 'https://git.kernel.org/stable/c/bc4013c7cce58d46f792c8c87bc8c8318a70190e'
  - url: 'https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403'
  - url: 'https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c'
  - url: 'https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5'
  - url: 'https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89481.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89481'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532184'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89481'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89481'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89481.mbox
  - url: 'https://access.redhat.com/errata/RHSA-2026:71602'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00413
epssPercentile: 0.35387
patched:
  - enterprise_linux_appstream_v_10
  - enterprise_linux_baseos_v_10
  - enterprise_linux_codeready_linux_builder_v_10
  - enterprise_linux_real_time_for_nfv_v_10
  - enterprise_linux_real_time_v_10
scores:
  cna: 7.5
  vendor: 7.1
ingestedAt: '2026-09-14T15:23:07.453Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix host memory disclosure on R2T for a read command

nvme_tcp_handle_r2t() does not check the direction of the request the
R2T refers to. A malicious controller can send an R2T for a READ and
the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the
H2CData header and nvme_tcp_try_send_data() sends the request's data
buffer. That buffer is the READ destination, so its contents go to the
controller.

The command then completes normally and nothing is logged.

Against a test controller that answers every READ with an R2T, a 4096
byte buffered read returned all 4096 bytes, split over two R2Ts. The
pages contained stale kernel data, including an array of struct page
pointers.

Reject an R2T for a request that is not a write.

## Affected

- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 49a4dcf57608ebf6432dbcb203ed25e7ed581445`
- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < bc4013c7cce58d46f792c8c87bc8c8318a70190e`
- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < a4c3c7310156493797c920b10d8648c07aa05403`
- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 3b3d27670c0c890ba7cf1bc3614cab61bde6d25c`
- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 3a0b05145053a5fad1a2ddb4e4d87b07385e63e5`
- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 6efbc52237facda35d2d874fe1765bb4839275d8`
- `Linux 5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:71602** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71602)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-30 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89481.json)