CVE-2026-89481 Overview
CVE-2026-89481 is an information disclosure vulnerability in the Linux kernel's NVMe over TCP (nvme-tcp) host driver. The function nvme_tcp_handle_r2t() fails to verify the direction of the request that a Ready-to-Transfer (R2T) PDU refers to. A malicious or compromised NVMe-oF controller can send an R2T in response to a READ command, causing the host to transmit the contents of the READ destination buffer back to the controller. Because the target buffer holds stale kernel data prior to being populated by the read, sensitive memory contents can leak to the attacker.
Critical Impact
A malicious NVMe/TCP controller can exfiltrate arbitrary kernel memory, including page pointers and other residual data, by responding to READ commands with crafted R2T PDUs. The command completes normally and nothing is logged.
Affected Products
- Linux kernel nvme-tcp host driver (multiple stable branches, fixed in commits 3a0b051, 3b3d276, 49a4dcf, 6efbc52, a4c3c73, bc4013c)
- Any Linux system acting as an NVMe over TCP initiator/host
- Distributions shipping affected kernel versions prior to the patched stable releases
Discovery Timeline
- 2026-09-11 - CVE-2026-89481 published to the National Vulnerability Database
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89481
Vulnerability Analysis
The NVMe/TCP protocol uses R2T (Ready-to-Transfer) PDUs to signal when a controller is ready to receive data from the host for a WRITE command. The host driver responds by sending H2CData (Host-to-Controller Data) PDUs carrying the write payload.
In the affected code path, nvme_tcp_handle_r2t() accepts any R2T from the controller without validating that the referenced request is a WRITE. When an R2T arrives for an in-flight READ request, nvme_tcp_setup_h2c_data_pdu() still constructs the H2CData header and nvme_tcp_try_send_data() transmits the request's data buffer. For a READ, that buffer is the destination allocated by the caller and contains prior kernel page contents rather than legitimate write data.
Testing against a controller that answered every READ with an R2T showed a 4096-byte buffered read returning all 4096 bytes to the controller across two R2Ts. The leaked pages contained stale kernel data, including an array of struct page pointers useful for further exploitation.
Root Cause
The root cause is missing input validation on a protocol control message. The host driver trusts the direction implied by the incoming R2T rather than cross-checking against the originating request's direction. This is an information disclosure defect driven by improper validation of untrusted controller input.
Attack Vector
Exploitation requires a malicious or compromised NVMe-oF target reachable over TCP by the victim host. No authentication or user interaction on the host is required beyond the host issuing normal READ I/O. The attacker replies with R2T PDUs for READ commands and receives the contents of the host's read buffers, which frequently contain uninitialized or stale kernel memory. The patched code path rejects any R2T that does not correspond to a WRITE request. Refer to the upstream commits listed in the references for the exact validation logic added to nvme_tcp_handle_r2t().
Detection Methods for CVE-2026-89481
Indicators of Compromise
- R2T PDUs sent by a controller in response to READ commands, observable in packet captures of NVMe/TCP traffic on TCP port 4420 or configured NVMe-oF ports.
- Unexpected H2CData PDUs transmitted by the host immediately following READ command submission.
- NVMe/TCP sessions established with untrusted or previously unknown target endpoints.
Detection Strategies
- Inspect NVMe/TCP traffic and correlate R2T PDUs with the direction of the referenced command IDs; any R2T tied to a READ is anomalous.
- Monitor kernel version and package inventory to identify hosts running unpatched nvme-tcp code.
- Alert on new outbound TCP connections from initiators to NVMe-oF targets outside of an approved allowlist.
Monitoring Recommendations
- Enable network telemetry on storage VLANs carrying NVMe/TCP and retain packet metadata for retrospective analysis.
- Track NVMe subsystem NQN connections via nvme list-subsys and audit changes.
- Log and review kernel messages from the nvme and nvme_tcp subsystems for connection resets and protocol errors.
How to Mitigate CVE-2026-89481
Immediate Actions Required
- Apply the stable kernel updates that include the fix to nvme_tcp_handle_r2t() referenced by commits 3a0b051, 3b3d276, 49a4dcf, 6efbc52, a4c3c73, and bc4013c.
- Restrict NVMe/TCP initiators to connect only to trusted, authenticated targets on isolated storage networks.
- Audit all currently connected NVMe-oF subsystems and disconnect any unrecognized targets.
Patch Information
The fix rejects any R2T PDU that references a request whose direction is not a write. Upstream commits are available from kernel.org: Linux Kernel Commit 3a0b051, Linux Kernel Commit 3b3d276, Linux Kernel Commit 49a4dcf, Linux Kernel Commit 6efbc52, Linux Kernel Commit a4c3c73, and Linux Kernel Commit bc4013c. Apply the update from your distribution vendor for the affected stable branch.
Workarounds
- Disconnect from NVMe/TCP targets that are not fully trusted using nvme disconnect -n <nqn> until kernels are patched.
- Unload the nvme_tcp module (modprobe -r nvme_tcp) on hosts that do not require NVMe over TCP connectivity.
- Enforce network segmentation and mutual authentication (for example, TLS via NVMe/TCP with --tls) to reduce exposure to untrusted controllers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
