CVE-2026-52989 Overview
CVE-2026-52989 is a Linux kernel vulnerability in the NVMe-over-TCP target subsystem (nvmet-tcp). The flaw resides in nvmet_tcp_build_pdu_iovec(), which returns void and fails to propagate fatal errors to its callers. When the function detects an out-of-bounds PDU length or offset, it invokes nvmet_tcp_fatal_error() and returns early, leaving cmd->recv_msg.msg_iter uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() then advance the queue state to NVMET_TCP_RECV_DATA, allowing the socket receive loop to read incoming network data into the uninitialized iterator.
Critical Impact
A remote attacker able to send crafted NVMe/TCP PDUs to an exposed target could trigger reads into uninitialized memory, leading to kernel memory corruption or denial of service.
Affected Products
- Linux kernel builds with CONFIG_NVME_TARGET_TCP enabled
- NVMe-over-TCP target deployments serving block storage to remote initiators
- Distribution kernels shipping the affected nvmet-tcp driver prior to the upstream fix
Discovery Timeline
- 2026-06-24 - CVE-2026-52989 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52989
Vulnerability Analysis
The nvmet-tcp driver implements the NVMe-over-Fabrics target side for the TCP transport. Incoming Host-to-Controller (H2C) data PDUs are processed by nvmet_tcp_handle_h2c_data_pdu(), which calls nvmet_tcp_build_pdu_iovec() to construct an iovec describing the data payload buffer.
When the helper validates the PDU length or offset and finds them out of bounds, it calls nvmet_tcp_fatal_error(cmd->queue) and returns. The function signature returns void, so callers cannot distinguish success from failure. The caller proceeds to set queue->rcv_state = NVMET_TCP_RECV_DATA despite the iterator never being initialized.
On the next socket read, the receive loop dereferences cmd->recv_msg.msg_iter and copies attacker-controlled network bytes into whatever stale memory the iterator references. This produces an uninitialized memory use condition in kernel context.
Root Cause
The root cause is improper error propagation. nvmet_tcp_build_pdu_iovec() performs bounds validation but discards the failure signal because of its void return type. The fix changes the function to return an error code, allowing nvmet_tcp_handle_h2c_data_pdu() and other callers to abort processing instead of transitioning the queue into the data-receive state with an uninitialized iterator.
Attack Vector
Exploitation requires network reachability to a Linux host configured as an NVMe-over-TCP target. An attacker authenticated at the transport layer or able to reach the discovery and I/O ports can send a malformed H2C data PDU specifying an out-of-bounds length or offset. The crafted PDU drives the queue into an inconsistent state where subsequent receive operations operate on uninitialized iterator memory.
No verified public proof-of-concept is available. Patch details are published across the upstream stable trees in commits 046fa5c, 3df42a8, c2a1144, d7c8f95, ea8e356, and f9204a2.
Detection Methods for CVE-2026-52989
Indicators of Compromise
- Kernel log entries from nvmet_tcp_fatal_error() followed by abnormal queue teardown on NVMe-over-TCP target hosts.
- Unexpected NVMe target session resets originating from a single or small set of initiator IP addresses.
- KASAN or KMSAN reports flagging uninitialized reads inside nvmet_tcp_try_recv_data or related receive paths.
Detection Strategies
- Audit running kernels with uname -r and compare against the fixed commit hashes listed in the upstream references for each stable branch.
- Enable CONFIG_KASAN on test systems to surface uninitialized iterator dereferences in nvmet-tcp under fuzzing.
- Inspect dmesg and journal output on storage targets for repeated nvmet_tcp fatal error messages tied to specific peers.
Monitoring Recommendations
- Monitor NVMe-over-TCP target processes for unexpected restarts and elevated rates of connection resets.
- Alert on anomalous source addresses initiating connections to ports 4420 and 8009, or any custom NVMe/TCP listener.
- Forward kernel ring buffer logs to a centralized analytics pipeline so storage subsystem faults are correlated with network telemetry.
How to Mitigate CVE-2026-52989
Immediate Actions Required
- Apply the distribution kernel update that incorporates the upstream nvmet-tcp fix.
- Restrict network access to NVMe-over-TCP listeners so only trusted initiator hosts can reach the target ports.
- Audit which servers expose nvmet-tcp and disable the module on systems that do not require it.
Patch Information
The fix changes nvmet_tcp_build_pdu_iovec() to return an error code and updates callers to honor it. Stable-tree commits include 046fa5c72d15, 3df42a854686, c2a11441538b, d7c8f95f599b, ea8e356acb16, and f9204a2b78dd. Rebuild or update to a kernel containing the corresponding commit for your stable branch.
Workarounds
- Unload the nvmet_tcp module on hosts that do not actively serve NVMe-over-TCP storage using modprobe -r nvmet_tcp.
- Place NVMe-over-TCP targets on isolated storage VLANs with strict ingress filtering to block untrusted initiators.
- Use host firewall rules to limit which client IP addresses can reach the configured NVMe/TCP listener ports.
# Configuration example
# Disable the nvmet-tcp module on systems that do not require it
sudo modprobe -r nvmet_tcp
echo 'blacklist nvmet_tcp' | sudo tee /etc/modprobe.d/blacklist-nvmet-tcp.conf
# Restrict NVMe/TCP discovery and I/O ports to trusted initiators only
sudo nft add rule inet filter input tcp dport { 4420, 8009 } ip saddr != 10.0.0.0/24 drop
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
