PT-2026-51883 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-52989

NVD

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: propagate nvmet tcp build pdu iovec() errors to its callers

Currently, when nvmet tcp build pdu iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet tcp fatal error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv msg.msg iter was left uninitialized.

Callers such as nvmet tcp handle h2c data pdu() proceed to blindly overwrite the queue state with queue->rcv state = NVMET TCP RECV DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator.

Fix this by shifting the error handling responsibility to the callers.

Related Identifiers

CVE-2026-52989

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-52989 · Security Note
• https://git.kernel.org/stable/c/046fa5c72d15cd8e2d592e275697ea399d8f76b0 · Note
• https://git.kernel.org/stable/c/c2a11441538bdbbc5aa003f190995eba93a89b88 · Note
• https://git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3 · Note
• https://git.kernel.org/stable/c/f9204a2b78dd18374d3bcf9bf93d9021ce22de1b · Note
• https://git.kernel.org/stable/c/ea8e356acb165cb1fd75537a52e1f66e5e76c538 · Note
• https://git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453c · Note