CVE-2026-89973: Linux Kernel NVMe-TCP Privilege Escalation

CVE-2026-89973 Overview

CVE-2026-89973 is a Linux kernel vulnerability in the nvme-tcp driver. The function nvme_tcp_handle_c2h_data() locates a request by command ID and validates that it has a payload. It does not verify that the command actually requested a data read. A malicious or malfunctioning NVMe-over-TCP controller can respond to a write command with a Controller-to-Host (C2HData) PDU. This triggers WARN_ON_ONCE(i->data_source) inside _copy_to_iter(), causing the receive path to return -EFAULT and reset the controller. On hosts booted with panic_on_warn, the warning becomes fatal.

Critical Impact
A remote NVMe-oF/TCP controller can trigger a kernel warning on demand, causing denial of service on hosts configured with panic_on_warn.

Affected Products

Linux kernel nvme-tcp driver (NVMe-over-TCP host)
Linux distributions shipping affected kernel versions prior to the referenced stable commits
Systems using NVMe/TCP transport that connect to untrusted or misbehaving controllers

Discovery Timeline

2026-09-16 - CVE-2026-89973 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89973

Vulnerability Analysis

The defect lies in the NVMe-over-TCP host-side receive path. When a C2HData PDU arrives, nvme_tcp_handle_c2h_data() matches it to an in-flight request by command ID and verifies a payload is present. The function omits a direction check. It never confirms that the original command was a read.

When the associated request is a write, its I/O iterator is configured as a data source, not a destination. The code path proceeds to nvme_tcp_recv_data(), which calls _copy_to_iter() against an iterator whose data_source flag is set. This triggers WARN_ON_ONCE(i->data_source) in lib/iov_iter.c. The copy returns 0 bytes, the caller translates that into -EFAULT, and the kernel resets the controller.

No memory is written, so this is not memory corruption. The impact is a controller-driven kernel warning. Hosts booted with panic_on_warn will panic, producing a denial of service condition classifiable as a kernel logic flaw in protocol input validation.

Root Cause

The send path already consults rq_data_dir() when building outbound commands, and nvme_tcp_handle_r2t() validates length and offset of the referenced request. The C2HData handler skipped an equivalent direction check. Trusting the controller to respond only with valid PDUs for the correct direction is the root cause. Improper input validation of protocol responses allows an attacker-controlled or faulty peer to steer the host into an unreachable code path.

Attack Vector

Exploitation requires an NVMe/TCP host to communicate with a controller that returns a C2HData PDU for a submitted write command. A network-positioned attacker able to impersonate or replace a controller, or a compromised storage target, can send such a PDU whenever the host issues a write. The write command ID and matching payload length in the PDU are sufficient to reach the vulnerable copy path.

The patched behavior rejects any C2HData PDU whose referenced command is not a read, failing the command and resetting the controller without emitting the warning. See the upstream fix in the Kernel Commit Update 0673a2a and related stable backports.

// No verified exploit code is available.
// The vulnerability is triggered by a malformed C2HData PDU from a controller
// referencing the command ID of an in-flight WRITE request.

Detection Methods for CVE-2026-89973

Indicators of Compromise

Kernel log entries containing WARNING: lib/iov_iter.c and _copy_to_iter+ in the stack trace originating from nvme_tcp_recv_skb or nvme_tcp_io_work.
Messages such as nvme nvmeX: queue N failed to copy request 0xYY data followed by receive failed: -14.
Repeated NVMe/TCP controller resets tied to a specific remote target address.

Detection Strategies

Aggregate dmesg and journald output from NVMe/TCP hosts and alert on the specific warning signature above.
Correlate controller reset events with the connected target IP to identify potentially malicious or faulty controllers.
Track kernel panics on hosts configured with panic_on_warn where the last recorded stack frame includes nvme_tcp_io_work.

Monitoring Recommendations

Ship kernel logs from all NVMe-oF/TCP initiators to a central logging or SIEM tier for signature-based alerting.
Monitor NVMe subsystem controller reconnect counters and treat spikes as investigation triggers.
Baseline expected NVMe/TCP peers and alert on connections to unexpected controller endpoints.

How to Mitigate CVE-2026-89973

Immediate Actions Required

Apply the upstream Linux kernel patch or a vendor-supplied backport that adds the C2HData direction check.
On hosts that cannot be patched immediately, disable panic_on_warn to prevent a single malformed PDU from causing a system panic.
Restrict NVMe/TCP initiators to communicate only with trusted controllers on isolated storage networks.

Patch Information

The fix rejects any C2HData PDU whose referenced command is not a read, failing the command and resetting the controller. Stable-tree backports are available in the following commits: 0673a2a, 5b115d9, 80d5620, 980d990, a0c389b, b4af799, df74950, and f83af37. Consult your Linux distribution's advisory for the specific kernel package version that carries the fix.

Workarounds

Boot without panic_on_warn so the kernel warning does not escalate to a panic on affected hosts.
Segment NVMe/TCP traffic onto a dedicated storage VLAN with strict access controls to reduce exposure to untrusted controllers.
Use mutual authentication (NVMe/TCP TLS or DH-CHAP where supported) so hosts do not connect to arbitrary controllers.

bash

# Temporarily disable panic_on_warn at runtime
sysctl -w kernel.panic_on_warn=0

# Persist the setting across reboots
echo 'kernel.panic_on_warn = 0' > /etc/sysctl.d/99-nvme-tcp-cve-2026-89973.conf

# Verify the current NVMe/TCP subsystem and connected controllers
nvme list-subsys