CVE-2026-89969 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
A remote unauthenticated attacker can trigger an out-of-bounds write in the Linux kernel's nvmet-tcp module by sending a crafted PDU, potentially leading to memory corruption and code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89969?
CVE-2026-89969 is a critical memory corruption vulnerability in Linux, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining payload length as
queue->left = hdr->hlen - queue->offset + hdgst;
and reads that many more bytes into &queue->pdu + queue->offset, without ever bounding the result against sizeof(queue->pdu).
A struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the union. Once a header digest has been negotiated (hdgst = 4), a second ICReq passes the hlen == nvmet_tcp_pdu_size() check but yields queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the 128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and queue->data_digest. Those bytes are attacker-controlled (an ICReq carries no digest), and the duplicate ICReq is only rejected later, after the overflow. A remote unauthenticated host can thus corrupt kernel memory adjacent to the receive buffer.
Reject any PDU whose declared length would read past the end of queue->pdu before the second recv.
Which versions are affected by CVE-2026-89969?
How do I fix CVE-2026-89969?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89969 being exploited?
There is no known exploitation of CVE-2026-89969 in the wild and no public exploit code.
Sources
Also known as AZL-101600, BELL-CVE-2026-89969, DEBIAN-CVE-2026-89969, GHSA-pcvm-4g32-rvg7, UBUNTU-CVE-2026-89969.