Answer in brief
CVE-2026-52989 records a Critical severity (CVSS 9.8) vulnerability in nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-52989 records a Critical severity (CVSS 9.8) vulnerability in nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1385be357e8acd09b36e026567f3a9d5c61139de <3df42a854686fa06484e37ac1a3931c8e3e3453c || >=dca1a6ba0da9f472ef040525fab10fd9956db59f <d7c8f95f599b3b38a717d2e771c3f8c174f657c3 || >=19672ae68d52ff75347ebe2420dde1b07adca09f <f9204a2b78dd18374d3bcf9bf93d9021ce22de1b || >=ab200d71553bdcf4de554a5985b05b2dd606bc57 <c2a11441538bdbbc5aa003f190995eba93a89b88 || >=52a0a98549344ca20ad81a4176d68d28e3c05a5c <046fa5c72d15cd8e2d592e275697ea399d8f76b0 || >=52a0a98549344ca20ad81a4176d68d28e3c05a5c <ea8e356acb165cb1fd75537a52e1f66e5e76c538 || 043b4307a99f902697349128fde93b2ddde4686c || 42afe8ed8ad2de9c19457156244ef3e1eca94b5d || >=6.1.163 <6.1.175 || >=6.6.124 <6.6.141 || >=6.12.70 <6.12.91 || >=6.18.10 <6.18.33 || >=5.10.250 <5.11 || >=5.15.200 <5.16 | 3df42a854686fa06484e37ac1a3931c8e3e3453c, d7c8f95f599b3b38a717d2e771c3f8c174f657c3, f9204a2b78dd18374d3bcf9bf93d9021ce22de1b, c2a11441538bdbbc5aa003f190995eba93a89b88, 046fa5c72d15cd8e2d592e275697ea399d8f76b0, ea8e356acb165cb1fd75537a52e1f66e5e76c538, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 5.11, 5.16 |
| Linux/Linuxgeneric | 6.19 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.
Quoted source text, attributed separately from HOL analysis.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1385be357e8acd09b36e026567f3a9d5c61139de <3df42a854686fa06484e37ac1a3931c8e3e3453c || >=dca1a6ba0da9f472ef040525fab10fd9956db59f <d7c8f95f599b3b38a717d2e771c3f8c174f657c3 || >=19672ae68d52ff75347ebe2420dde1b07adca09f <f9204a2b78dd18374d3bcf9bf93d9021ce22de1b || >=ab200d71553bdcf4de554a5985b05b2dd606bc57 <c2a11441538bdbbc5aa003f190995eba93a89b88 || >=52a0a98549344ca20ad81a4176d68d28e3c05a5c <046fa5c72d15cd8e2d592e275697ea399d8f76b0 || >=52a0a98549344ca20ad81a4176d68d28e3c05a5c <ea8e356acb165cb1fd75537a52e1f66e5e76c538 || 043b4307a99f902697349128fde93b2ddde4686c || 42afe8ed8ad2de9c19457156244ef3e1eca94b5d || >=6.1.163 <6.1.175 || >=6.6.124 <6.6.141 || >=6.12.70 <6.12.91 || >=6.18.10 <6.18.33 || >=5.10.250 <5.11 || >=5.15.200 <5.16 | 3df42a854686fa06484e37ac1a3931c8e3e3453c, d7c8f95f599b3b38a717d2e771c3f8c174f657c3, f9204a2b78dd18374d3bcf9bf93d9021ce22de1b, c2a11441538bdbbc5aa003f190995eba93a89b88, 046fa5c72d15cd8e2d592e275697ea399d8f76b0, ea8e356acb165cb1fd75537a52e1f66e5e76c538, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 5.11, 5.16 |
| Linux/Linuxgeneric | 6.19 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.
Quoted source text, attributed separately from HOL analysis.