CVE-2026-89480 Overview
CVE-2026-89480 is a Linux kernel vulnerability in the NVMe over TCP (nvme-tcp) driver. The driver completes read requests without verifying that the controller returned the requested number of bytes. A malicious or malfunctioning NVMe/TCP controller can respond to a 4096-byte read with fewer bytes, and the kernel reports the read as fully successful. User space then receives uninitialized page contents in place of the missing data, resulting in information disclosure from kernel memory.
Critical Impact
A remote NVMe/TCP controller can leak stale kernel page contents to user space by returning short reads that the driver treats as complete.
Affected Products
- Linux kernel nvme-tcp driver (upstream)
- Stable kernel branches receiving backports referenced in the fix commits
- Distributions that ship the affected nvme-tcp client
Discovery Timeline
- 2026-09-11 - CVE-2026-89480 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89480
Vulnerability Analysis
The defect lives in nvme_tcp_recv_data(), which completes a request as soon as the current Controller-to-Host Data (C2HData) Protocol Data Unit (PDU) is consumed. Nothing tracks the cumulative bytes received for a single request. struct nvme_tcp_request has no receive-side counter, queue->data_remaining is scoped per queue, and blk_mq_end_request() completes for blk_rq_bytes(rq) unconditionally, with no residual byte concept propagated upward.
Because of this gap, a controller answering a 4096-byte read with only 512 bytes will still cause the request to complete successfully. User space receives a buffer of the requested length, of which the tail (3584 bytes in the reproducer) contains whatever data was already resident in the underlying page. The reporter reproduced the flaw using a test target.
Root Cause
The root cause is missing input validation on the length of transferred read data, a class of Information Exposure defect. The completion path trusts the PDU stream to deliver exactly the amount requested, without any accounting to enforce the contract before signalling success to the block layer.
Attack Vector
Exploitation requires an attacker-controlled or compromised NVMe/TCP target that a Linux initiator connects to over the network. The attacker crafts C2HData PDUs that under-deliver bytes for REQ_OP_READ requests while still signalling NVME_TCP_F_DATA_SUCCESS. Passthrough commands are out of scope, because the submitter picks both command and buffer, leaving no reference length the kernel can validate against.
The upstream fix counts received bytes per request and refuses to complete a successful read whose count does not match the expected length. The check is applied at both NVME_TCP_F_DATA_SUCCESS paths and inside nvme_tcp_process_nvme_cqe(), with req->status shifted right by one so the comparison observes the same value the completion path will use.
Detection Methods for CVE-2026-89480
Indicators of Compromise
- NVMe/TCP sessions established with untrusted or unexpected controller endpoints.
- C2HData PDUs whose payload length is smaller than the originating command's transfer length.
- Application-level data corruption or unexpected content patterns following NVMe/TCP reads.
Detection Strategies
- Inspect kernel version and nvme-tcp module against the fix commits (7fa3f73f, 832a685e, 8a02ad98, 99066cf9, a5c1bb0f, aa107e3a, fca3ebb6) on stable branches.
- Use packet capture on storage networks to correlate NVMe/TCP command transfer lengths with actual C2HData bytes delivered.
- Alert on new NVMe/TCP connect operations to controllers outside the approved storage fabric inventory.
Monitoring Recommendations
- Track nvme subsystem events via dmesg and nvme-cli for anomalous completions and reconnects.
- Baseline expected NVMe/TCP peers per host and alert on deviations at the network layer.
- Monitor for lateral movement paths that could allow an attacker to stand up a rogue NVMe/TCP target reachable by initiators.
How to Mitigate CVE-2026-89480
Immediate Actions Required
- Update to a Linux kernel that includes the referenced stable commits fixing nvme_tcp_recv_data().
- Restrict NVMe/TCP initiators to controllers on trusted, segmented storage networks only.
- Audit connected NVMe/TCP targets on every initiator and disconnect any unrecognized endpoints.
Patch Information
The fix is available through the following upstream commits on kernel.org: Kernel Commit 7fa3f73f, Kernel Commit 832a685e, Kernel Commit 8a02ad98, Kernel Commit 99066cf9, Kernel Commit a5c1bb0f, Kernel Commit aa107e3a, and Kernel Commit fca3ebb6. Apply the vendor kernel package that includes these backports.
Workarounds
- Disconnect NVMe/TCP sessions to any controller outside strict administrative control until patched.
- Enforce network segmentation and mutual authentication (for example, NVMe-oF in-band authentication) between initiators and targets.
- Where feasible, prefer local NVMe or NVMe over Fabrics transports whose targets are fully trusted.
# Verify running kernel and list active NVMe/TCP controllers
uname -r
nvme list-subsys
nvme list
# Disconnect an untrusted NVMe/TCP subsystem until patching completes
nvme disconnect -n <subsystem-nqn>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
