CVE-2026-52989 nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
A Linux kernel NVMe-oF TCP bug allows remote attackers to cause a denial of service by triggering uninitialized memory access during PDU processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52989?
CVE-2026-52989 is a critical vulnerability in Linux kernel, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized.
Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator.
Fix this by shifting the error handling responsibility to the callers.
Which versions are affected by CVE-2026-52989?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-52989?
Apply the vendor's patch.
Is CVE-2026-52989 being exploited?
There is no known exploitation of CVE-2026-52989 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-52989, DEBIAN-CVE-2026-52989, GHSA-m4w6-2g7f-9j5p, ROOT-OS-DEBIAN-11-CVE-2026-52989, ROOT-OS-DEBIAN-12-CVE-2026-52989, ROOT-OS-UBUNTU-2204-CVE-2026-52989 and 2 more.