CVE-2026-89481

The Linux kernel's NVMe-over-TCP (nvme-tcp) driver fails to validate the command direction when handling an R2T (Ready-to-Transfer) PDU, because nvme_tcp_handle_r2t() never checks whether the referenced request is a write. A malicious or compromised NVMe controller can send an R2T for a READ command, causing the host to transmit the contents of that request's destination buffer back to the controller via H2CData PDUs; that buffer holds stale kernel heap memory, which in testing included an array of struct page pointers. The disclosure is silent: the command completes normally and nothing is logged, letting a hostile storage target harvest kernel memory byte-for-byte across repeated reads. Any Linux host using the nvme-tcp transport is affected, but exploitation requires the attacker to control or impersonate the NVMe/TCP controller the host connects to, so the trust boundary is the storage target. No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not in the CISA KEV catalog.

What to do: Apply a kernel update containing the upstream fix (rejecting R2Ts for non-write requests) once it reaches your distro's stable or LTS kernel series. In the interim, mitigate by only connecting nvme-tcp initiators to trusted, authenticated controllers on private networks, since the attacker must be the storage target. Verify whether you are exposed at all with 'nvme list-subsys' and 'lsmod | grep nvme_tcp' — hosts not using NVMe over TCP are not affected.