In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: check the data direction of a C2HData PDU

nvme_tcp_handle_c2h_data() finds the request by command id and checks
that it has a payload, but it does not check that the command asked for
data to be read. A controller that answers a write command with C2HData
therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits
WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that
into -EFAULT and resets the controller.

No data is copied, so this is not memory corruption. What a controller
gets is a kernel warning it can raise at will, which is fatal on a host
booted with panic_on_warn.

The send path already knows the direction - it consults rq_data_dir()
when it builds a command - and nvme_tcp_handle_r2t() checks the length
and the offset of the request it names. The C2HData path does not check
the direction at all.

Reject a C2HData PDU whose command is not a read. Rejecting it fails
the command and resets the controller, as the neighbouring check in this
function does; what goes away is the warning.

[ 6.885580] ------------[ cut here ]------------
[ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71
[ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy)
[ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work
[ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330
[ 6.903739] Call Trace:
[ 6.904085] <TASK>
[ 6.909254] __skb_datagram_iter+0x433/0x820
[ 6.911026] skb_copy_datagram_iter+0x37/0x120
[ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320
[ 6.913378] __tcp_read_sock+0x1ab/0x810
[ 6.915788] nvme_tcp_try_recv+0x152/0x1e0
[ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0
[ 6.926906] </TASK>
[ 6.927226] ---[ end trace 0000000000000000 ]---
[ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data
[ 6.928709] nvme nvme0: receive failed: -14

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
3f2304f8c6d6ed97849057bd16fee99e434ca796 affected < df74950ba6008655d4a977d17df7faf4b6e52b74
3f2304f8c6d6ed97849057bd16fee99e434ca796 affected < 980d990f3c0560d7dfbfbf14699651fdf02f26ee
3f2304f8c6d6ed97849057bd16fee99e434ca796 affected < 5b115d932f6e769ac80783fb18edd21b0aed256e
3f2304f8c6d6ed97849057bd16fee99e434ca796 affected < 0673a2affe45ca76b60de31a83c67b1e60f81bde
3f2304f8c6d6ed97849057bd16fee99e434ca796 affected < 80d56202fbdff8906be6954b2776e5c14a4026f2
3f2304f8c6d6ed97849057bd16fee99e434ca796 affected < b4af7999a998787d5eb6facb5a333e04a4f1d2d9
3f2304f8c6d6ed97849057bd16fee99e434ca796 affected < a0c389b8a495bda1eb719d2503853c924b7a8355
3f2304f8c6d6ed97849057bd16fee99e434ca796 affected < f83af377c148f6ad94b41c0e8313f12adf45e1c1
Linux Linux affected
Version Status Constraints
5.0 affected —
0 unaffected < 5.0
5.10.270 unaffected ≤ 5.10.*
5.15.221 unaffected ≤ 5.15.*
6.1.188 unaffected ≤ 6.1.*
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.51 unaffected ≤ 6.18.*
7.2.5 unaffected ≤ 7.2.*
7.3-rc2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0673a2affe45ca76b60de31a83c67b1e60f81bde cve-icon
https://git.kernel.org/stable/c/5b115d932f6e769ac80783fb18edd21b0aed256e cve-icon
https://git.kernel.org/stable/c/80d56202fbdff8906be6954b2776e5c14a4026f2 cve-icon
https://git.kernel.org/stable/c/980d990f3c0560d7dfbfbf14699651fdf02f26ee cve-icon
https://git.kernel.org/stable/c/a0c389b8a495bda1eb719d2503853c924b7a8355 cve-icon
https://git.kernel.org/stable/c/b4af7999a998787d5eb6facb5a333e04a4f1d2d9 cve-icon
https://git.kernel.org/stable/c/df74950ba6008655d4a977d17df7faf4b6e52b74 cve-icon
https://git.kernel.org/stable/c/f83af377c148f6ad94b41c0e8313f12adf45e1c1 cve-icon
History

Wed, 16 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvme_tcp_handle_c2h_data() finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answers a write command with C2HData therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that into -EFAULT and resets the controller. No data is copied, so this is not memory corruption. What a controller gets is a kernel warning it can raise at will, which is fatal on a host booted with panic_on_warn. The send path already knows the direction - it consults rq_data_dir() when it builds a command - and nvme_tcp_handle_r2t() checks the length and the offset of the request it names. The C2HData path does not check the direction at all. Reject a C2HData PDU whose command is not a read. Rejecting it fails the command and resets the controller, as the neighbouring check in this function does; what goes away is the warning. [ 6.885580] ------------[ cut here ]------------ [ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71 [ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work [ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330 [ 6.903739] Call Trace: [ 6.904085] <TASK> [ 6.909254] __skb_datagram_iter+0x433/0x820 [ 6.911026] skb_copy_datagram_iter+0x37/0x120 [ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320 [ 6.913378] __tcp_read_sock+0x1ab/0x810 [ 6.915788] nvme_tcp_try_recv+0x152/0x1e0 [ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0 [ 6.926906] </TASK> [ 6.927226] ---[ end trace 0000000000000000 ]--- [ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data [ 6.928709] nvme nvme0: receive failed: -14
Title nvme-tcp: check the data direction of a C2HData PDU
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-16T10:32:52.409Z

Reserved: 2026-09-11T19:38:34.779Z

Link: CVE-2026-89973

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.