Bug 2532184 (CVE-2026-89481)

Summary: CVE-2026-89481 kernel: nvme-tcp: fix host memory disclosure on R2T for a read command
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) over TCP (nvme-tcp) component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer (R2T) command for a read request. The host system, failing to properly validate the request direction, will then send the contents of its read destination buffer to the controller. This can lead to the disclosure of stale kernel memory data, potentially revealing sensitive information.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-11 21:11:12 UTC 
In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix host memory disclosure on R2T for a read command

nvme_tcp_handle_r2t() does not check the direction of the request the
R2T refers to. A malicious controller can send an R2T for a READ and
the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the
H2CData header and nvme_tcp_try_send_data() sends the request's data
buffer. That buffer is the READ destination, so its contents go to the
controller.

The command then completes normally and nothing is logged.

Against a test controller that answers every READ with an R2T, a 4096
byte buffered read returned all 4096 bytes, split over two R2Ts. The
pages contained stale kernel data, including an array of struct page
pointers.

Reject an R2T for a request that is not a write.
Comment 1 Mauro Matteo Cascella 2026-09-18 09:27:11 UTC 
Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89481.mbox
Comment 4 Jon Orris 2026-09-24 15:05:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:71602 https://access.redhat.com/errata/RHSA-2026:71602
Comment 5 Jon Orris 2026-10-05 10:48:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:75746 https://access.redhat.com/errata/RHSA-2026:75746
Comment 6 Jon Orris 2026-10-05 11:24:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:75747 https://access.redhat.com/errata/RHSA-2026:75747
Comment 7 Jon Orris 2026-10-08 09:50:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:76739 https://access.redhat.com/errata/RHSA-2026:76739