Answer in brief
CVE-2026-89973 records a High severity (CVSS 8.2) vulnerability in nvme-tcp: check the data direction of a C2HData PDU. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3f2304f8c6d6ed97849057bd16fee99e434ca796 <df74950ba6008655d4a977d17df7faf4b6e52b74 || >=3f2304f8c6d6ed97849057bd16fee99e434ca796 <980d990f3c0560d7dfbfbf14699651fdf02f26ee || >=3f2304f8c6d6ed97849057bd16fee99e434ca796 <5b115d932f6e769ac80783fb18edd21b0aed256e || >=3f2304f8c6d6ed97849057bd16fee99e434ca796 <0673a2affe45ca76b60de31a83c67b1e60f81bde || >=3f2304f8c6d6ed97849057bd16fee99e434ca796 <80d56202fbdff8906be6954b2776e5c14a4026f2 || >=3f2304f8c6d6ed97849057bd16fee99e434ca796 <b4af7999a998787d5eb6facb5a333e04a4f1d2d9 || >=3f2304f8c6d6ed97849057bd16fee99e434ca796 <a0c389b8a495bda1eb719d2503853c924b7a8355 || >=3f2304f8c6d6ed97849057bd16fee99e434ca796 <f83af377c148f6ad94b41c0e8313f12adf45e1c1 | df74950ba6008655d4a977d17df7faf4b6e52b74, 980d990f3c0560d7dfbfbf14699651fdf02f26ee, 5b115d932f6e769ac80783fb18edd21b0aed256e, 0673a2affe45ca76b60de31a83c67b1e60f81bde, 80d56202fbdff8906be6954b2776e5c14a4026f2, b4af7999a998787d5eb6facb5a333e04a4f1d2d9, a0c389b8a495bda1eb719d2503853c924b7a8355, f83af377c148f6ad94b41c0e8313f12adf45e1c1 |
| Linux/Linuxgeneric | 5.0 | Not reported |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvme_tcp_handle_c2h_data() finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answers a write command with C2HData therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that into -EFAULT and resets the controller. No data is copied, so this is not memory corruption. What a controller gets is a kernel warning it can raise at will, which is fatal on a host booted with panic_on_warn. The send path already knows the direction - it consults rq_data_dir() when it builds a command - and nvme_tcp_handle_r2t() checks the length and the offset of the request it names. The C2HData path does not check the direction at all. Reject a C2HData PDU whose command is not a read. Rejecting it fails the command and resets the controller, as the neighbouring check in this function does; what goes away is the warning. [ 6.885580] ------------[ cut here ]------------ [ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71 [ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work [ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330 [ 6.903739] Call Trace: [ 6.904085] <TASK> [ 6.909254] __skb_datagram_iter+0x433/0x820 [ 6.911026] skb_copy_datagram_iter+0x37/0x120 [ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320 [ 6.913378] __tcp_read_sock+0x1ab/0x810 [ 6.915788] nvme_tcp_try_recv+0x152/0x1e0 [ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0 [ 6.926906] </TASK> [ 6.927226] ---[ end trace 0000000000000000 ]--- [ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data [ 6.928709] nvme nvme0: receive failed: -14
Quoted source text, attributed separately from HOL analysis.