Look up another CVE · open CVE-2026-52989 in the interactive tracker

CVE-2026-52989

nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

9.8 EPSS 0.4% AV:N

Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem drivers/nvme. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-52989 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixedDLA-4665-1 · 2026-07-03 · text	6.1.176-1	Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.94-1	Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.0.10-1	Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.0.10-1	Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/nvme/target/tcp.c

What this is: NVM EXPRESS TARGET DRIVERMAINTAINERS section matched on drivers/nvme/target/ · linux-nvme@lists.infradead.org · Supported
Kernel module: nvmet_tcp

Check it on the machine

grep -w CONFIG_NVME_TARGET_TCP /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w nvmet_tcp

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switch: CONFIG_NVME_TARGET_TCP

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-06-24 (4 months ago)source
CVSS: 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.36%, higher than 27.8% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: drivers/nvme

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.1.163	6.1.175	3df42a854686
6.6.124	6.6.141	d7c8f95f599b
6.12.70	6.12.91	f9204a2b78dd
6.18.10	6.18.33	c2a11441538b
6.19	7.0.10	046fa5c72d15
6.19	7.1	ea8e356acb16
5.10.250	0	0
5.15.200	0	0

Debian advisories

Advisory	Date	Shipped to	Debian
DLA-4671-1	2026-07-05	bullseye 6.1.176-1~deb11u1	tracker
DLA-4665-1	2026-07-03	bookworm 6.1.176-1	tracker

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: nvmet-tcp is a network-facing NVMe-over-TCP target transport, and the vulnerable path is reached by sending crafted NVMe/TCP PDUs over an accepted TCP connection.
AC:LAttack complexity, low: The attacker controls the NVMe/TCP command and H2CData PDU lengths/offsets needed to make nvmet_tcp_build_pdu_iovec() fail; no race or hard-to-influence condition is required.
PR:NPrivileges required, none: In a reasonable deployment without DH-HMAC-CHAP/TLS enforcement, a remote initiator can connect and send the crafted sequence without prior privileges, and host NQN based admission is not a strong privilege boundary.
UI:NUser interaction, none: No victim action is required after the nvmet-tcp service is listening; exploitation is driven entirely by network traffic from the attacker.
S:UScope, unchanged: The impact is within the vulnerable kernel/NVMe target security authority and does not cross a separate scope such as guest-to-host or IOMMU isolation.
C:HConfidentiality impact, high: The bug can cause attacker-controlled network data to be received through an uninitialized or stale kernel iterator, creating memory corruption that is plausibly usable to disclose kernel or target memory.
I:HIntegrity impact, high: The stale destination iterator can turn received network data into a kernel memory write primitive, making arbitrary corruption or code execution defensible.
A:HAvailability impact, high: Even without full exploitation, the invalid receive through an uninitialized/stale iterator can trigger kernel oops, GPF/KASAN failures, or panic, causing high availability impact.