CVE-2026-89969: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89969 Overview

CVE-2026-89969 is an out-of-bounds write vulnerability in the Linux kernel's NVMe over TCP target subsystem (nvmet-tcp). The flaw resides in nvmet_tcp_try_recv_pdu(), which reads a Protocol Data Unit (PDU) header into a fixed 128-byte queue->pdu union without bounding the computed payload length against the buffer size. A remote unauthenticated attacker can send a crafted ICReq PDU with a negotiated header digest to write attacker-controlled bytes past the buffer boundary, corrupting adjacent kernel memory. The vulnerability affects Linux kernel systems exposing NVMe-oF/TCP targets on the network.

Critical Impact
A remote unauthenticated host can corrupt kernel memory adjacent to the receive buffer through an over-long PDU, enabling potential remote code execution in kernel context.

Affected Products

Linux kernel with nvmet-tcp (NVMe-over-TCP target) module enabled
Linux distributions running affected upstream kernel versions prior to the fix commits
Storage systems exposing NVMe-oF/TCP targets to untrusted networks

Discovery Timeline

2026-09-16 - CVE-2026-89969 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89969

Vulnerability Analysis

The vulnerability affects the NVMe-over-TCP target driver (nvmet-tcp) in the Linux kernel. This subsystem allows a Linux host to act as an NVMe target reachable over TCP, exposing block storage to remote initiators. The receive path parses incoming PDUs into a fixed 128-byte union buffer named queue->pdu.

When a client sends an Initialize Connection Request (ICReq) PDU and a header digest has been negotiated, the length calculation in nvmet_tcp_try_recv_pdu() produces a byte count that exceeds the buffer capacity. The remaining bytes are copied into the buffer at an offset, writing four bytes past the end of the union and overwriting queue->hdr_digest and queue->data_digest fields. Because the ICReq itself carries no digest, the overflow bytes are fully attacker-controlled. The duplicate ICReq check that would reject the frame executes only after the memory corruption occurs.

Root Cause

The root cause is a missing bounds check between the declared PDU length and the size of the fixed receive buffer. The kernel computes queue->left = hdr->hlen - queue->offset + hdgst and issues a recv of that many bytes into &queue->pdu + queue->offset without validating that the result stays within sizeof(queue->pdu). A struct nvme_tcp_icreq_pdu is 128 bytes — exactly the union size — so any header digest addition pushes the write past the buffer end. This is a classic Out-of-Bounds Write caused by improper input validation of a network-supplied length field.

Attack Vector

An unauthenticated remote attacker with network reachability to the NVMe-oF/TCP target port initiates a TCP connection to the target. The attacker first completes an ICReq/ICResp exchange that negotiates header digest support (hdgst = 4). The attacker then sends a second ICReq PDU whose header passes the hlen == nvmet_tcp_pdu_size() validation. The kernel computes a residual length of 124 bytes and writes bytes 8..132 into the 128-byte buffer, corrupting adjacent kernel memory with attacker-chosen values. No authentication is required prior to exploitation.

See the upstream kernel fix commit for the patched validation logic.

Detection Methods for CVE-2026-89969

Indicators of Compromise

Unexpected TCP connections to NVMe-oF target ports (default 4420) from untrusted source addresses
Kernel oops, panic, or KASAN reports referencing nvmet_tcp_try_recv_pdu or queue->pdu
Duplicate ICReq PDUs observed on the same NVMe-TCP session prior to a controller crash
Abnormal nvmet-tcp target queue teardowns and reconnection storms in kernel logs

Detection Strategies

Monitor kernel ring buffer (dmesg, journalctl -k) for nvmet_tcp warnings, slab corruption, or KASAN out-of-bounds write reports
Deploy network sensors that flag NVMe-TCP PDU streams with malformed or duplicated ICReq frames
Correlate storage host reboots or NVMe target service restarts with inbound connections from non-inventoried initiators

Monitoring Recommendations

Log and alert on all TCP flows to NVMe-oF target ports and restrict them to known initiator subnets
Enable kernel address sanitizer (KASAN) on non-production kernels to accelerate identification of memory corruption attempts
Ingest Linux kernel and audit logs into a centralized data lake for retrospective hunting against exploitation patterns

How to Mitigate CVE-2026-89969

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all systems running nvmet-tcp
Restrict access to NVMe-oF/TCP target ports (typically 4420) to trusted initiator networks using host or network firewalls
Disable the nvmet-tcp module on hosts that do not require NVMe-over-TCP target functionality
Audit storage fabric exposure and remove any NVMe-oF/TCP endpoints reachable from untrusted networks

Patch Information

The fix rejects any PDU whose declared length would read past the end of queue->pdu before the second recv call. Patches are available in the mainline and stable kernel trees. See the following upstream commits: 14cc5a7e7773, 3a385e0c39ef, 4f84d42c53c4, 58dc6035b79c, a3f0bcfbaf33, cf5f39d2b58f, d95d342bc0ea, and dbc4acbdb3ca. Track your distribution's advisory feed for backported package releases.

Workarounds

Unload the nvmet-tcp kernel module (modprobe -r nvmet_tcp) on systems that do not require it, and blacklist it from auto-loading
Enforce network segmentation so that only authenticated storage initiators can reach the NVMe-oF target port
Terminate any exposed NVMe subsystem TCP ports (nvmetcli) until patched kernels are deployed

bash

# Configuration example: disable nvmet-tcp until patched
sudo modprobe -r nvmet_tcp
echo "blacklist nvmet_tcp" | sudo tee /etc/modprobe.d/blacklist-nvmet-tcp.conf

# Restrict inbound NVMe-oF/TCP (default port 4420) to trusted initiators
sudo iptables -A INPUT -p tcp --dport 4420 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 4420 -j DROP