CVE-2026-52989
published 2026-06-24CVE-2026-52989: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when…
PriorityP347critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.35%
26.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds
PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue)
and returns early. However, because the function returns void, the
callers are entirely unaware that a fatal error has occurred and
that the cmd->recv_msg.msg_iter was left uninitialized.
Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly
overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA
Consequently, the socket receiving loop may attempt to read incoming
network data into the uninitialized iterator.
Fix this by shifting the error handling responsibility to the callers.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 1385be357e8acd09b36e026567f3a9d5c61139de < 3df42a854686fa06484e37ac1a3931c8e3e3453c | 3df42a854686fa06484e37ac1a3931c8e3e3453c |
| linux | linux | >= 19672ae68d52ff75347ebe2420dde1b07adca09f < f9204a2b78dd18374d3bcf9bf93d9021ce22de1b | f9204a2b78dd18374d3bcf9bf93d9021ce22de1b |
| linux | linux | >= 5.10.250 < 5.11 | 5.11 |
| linux | linux | >= 5.15.200 < 5.16 | 5.16 |
| linux | linux | >= 52a0a98549344ca20ad81a4176d68d28e3c05a5c < 046fa5c72d15cd8e2d592e275697ea399d8f76b0 | 046fa5c72d15cd8e2d592e275697ea399d8f76b0 |
| linux | linux | >= 52a0a98549344ca20ad81a4176d68d28e3c05a5c < ea8e356acb165cb1fd75537a52e1f66e5e76c538 | ea8e356acb165cb1fd75537a52e1f66e5e76c538 |
| linux | linux | >= 6.1.163 < 6.1.175 | 6.1.175 |
| linux | linux | >= 6.12.70 < 6.12.91 | 6.12.91 |
| linux | linux | >= 6.18.10 < 6.18.33 | 6.18.33 |
| linux | linux | >= 6.6.124 < 6.6.141 | 6.6.141 |
| linux | linux | >= ab200d71553bdcf4de554a5985b05b2dd606bc57 < c2a11441538bdbbc5aa003f190995eba93a89b88 | c2a11441538bdbbc5aa003f190995eba93a89b88 |
| linux | linux | >= dca1a6ba0da9f472ef040525fab10fd9956db59f < d7c8f95f599b3b38a717d2e771c3f8c174f657c3 | d7c8f95f599b3b38a717d2e771c3f8c174f657c3 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.10.250 < 5.11 | 5.11 |
| linux | linux_kernel | >= 5.15.200 < 5.16 | 5.16 |
| linux | linux_kernel | >= 6.1.163 < 6.1.175 | 6.1.175 |
| linux | linux_kernel | >= 6.12.70 < 6.12.91 | 6.12.91 |
| linux | linux_kernel | >= 6.18.10 < 6.18.33 | 6.18.33 |
| linux | linux_kernel | >= 6.19.1 < 7.0.10 | 7.0.10 |
| linux | linux_kernel | >= 6.6.124 < 6.6.141 | 6.6.141 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0.9 nvmet-tcp nvmet_tcp_build_pdu_iovec queue out-of-bounds (WID-SEC-2026-2077)
vuldb·2026-07-18·CVSS 9.8
CVE-2026-52989 [CRITICAL] Linux Kernel up to 7.0.9 nvmet-tcp nvmet_tcp_build_pdu_iovec queue out-of-bounds (WID-SEC-2026-2077)
A vulnerability was found in Linux Kernel up to 6.1.174/6.6.140/6.12.90/6.18.32/7.0.9 and classified as critical. The affected element is the function nvmet_tcp_build_pdu_iovec of the component nvmet-tcp. Such manipulation of the argument queue leads to out-of-bounds read.
This vulnerability is uniquely identified as CVE-2026-52989. The attack can only be initiated within the local network. No exploit exists.
It is suggested to upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-
ghsa_unreviewed·2026-06-24
CVE-2026-52989 In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds
PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue)
and returns early. However, because the function returns void, the
callers are entirely unaware that a fatal error has occurred and
that the cmd->recv_msg.msg_iter was left uninitialized.
Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly
overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA
Consequently, the socket receiving loop may attempt to read incoming
network data into the uninitialized iterator.
Fix this by shifting the error handling responsibility to the callers.
Red Hat
kernel: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
vendor_redhat·2026-06-24·CVSS 7.0
CVE-2026-52989 [HIGH] CWE-390 kernel: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
kernel: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
A flaw was found in the `nvmet-tcp` component of the Linux kernel. The `nvmet_tcp_build_pdu_iovec()` function fails to propagate errors when detecting out-of-bounds PDU lengths or offsets. This can lead to uninitialized memory being used by subsequent operations, such as reading incoming network data into an uninitialized iterator. A remote attacker could potentially exploit this memory corruption to cause a denial of service or achieve arbitrary code execution.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package:
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/046fa5c72d15cd8e2d592e275697ea399d8f76b0https://git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453chttps://git.kernel.org/stable/c/c2a11441538bdbbc5aa003f190995eba93a89b88https://git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3https://git.kernel.org/stable/c/ea8e356acb165cb1fd75537a52e1f66e5e76c538https://git.kernel.org/stable/c/f9204a2b78dd18374d3bcf9bf93d9021ce22de1bhttps://access.redhat.com/security/cve/CVE-2026-52989https://bugzilla.redhat.com/show_bug.cgi?id=2492443https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52989.json
2026-06-24
Published