---
cve: "CVE-2026-89480"
severity: "HIGH"
cvss: 7.5
epss: "0.4%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-11 20:19:29"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-27T16:22:33+02:00"
---

# CVE-2026-89480

> 7.5 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: reject a read that transferred too few bytes

nvme_tcp_recv_data() completes a request once the current C2HData PDU
has been consumed. Nothing compares the total bytes received against
the length the command asked for: struct nvme_tcp_request has no
receive-side counter, queue->data_remaining is per queue, and
blk_mq_end_request() completes for blk_rq_bytes(rq) unconditionally
with no residual concept anywhere above.

A controller can therefore answer a 4096-byte read with 512 bytes and
have it reported as a complete read; user space then gets 4096 bytes of
which 3584 are whatever was already in the page. I reproduced that with
a test target.

Count the bytes received and refuse to complete a successful read whose
count does not match, at the two NVME_TCP_F_DATA_SUCCESS paths and in
nvme_tcp_process_nvme_cqe(). The success test shifts req->status right
by one, because the driver keeps the wire value there and shifts it on
completion, so the check must see what the completion path will see.
Only REQ_OP_READ is checked, because there the length comes from the
sectors the request covers; a passthrough command is built by its
submitter, which picks both command and buffer, so the kernel has
nothing to compare against.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Patch verfügbar (OSV)

- Kernel ≥ 5.15.221
- Kernel ≥ 6.1.188
- Kernel ≥ 6.6.157
- Kernel ≥ 6.12.109
- Kernel ≥ 6.18.50
- Kernel ≥ 7.2.4

## BSI-Hinweise (deutsch)

- [Linux Kernel: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3321) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten oder den Systemzustand zu manipulieren, Denial-of-Service-Zustände herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.

## Referenzen

- <https://git.kernel.org/stable/c/a5c1bb0fb1bab2f24a081339c145870697f6d220>
- <https://git.kernel.org/stable/c/aa107e3a68f4af177d60f2d87679e7f67179a36c>
- <https://git.kernel.org/stable/c/fca3ebb63e5c82561cd9934365dcc0d068008006>
- <https://git.kernel.org/stable/c/99066cf9bba175f610ceb61a35f6fc9fbc33ff65>
- <https://git.kernel.org/stable/c/8a02ad98798fd01f51f648c1fdd8f3c9d07195d3>
- <https://git.kernel.org/stable/c/832a685efeb5d925ee7d30011d2dbe45f81447a3>
- <https://git.kernel.org/stable/c/7fa3f73f6c8ddc5f0425b50fb2a626a782ef7d12>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-89480) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_