---
cve: "CVE-2026-89481"
severity: "HIGH"
cvss: 7.5
epss: "0.4%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-11 20:19:29"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-20T00:55:14+02:00"
---

# CVE-2026-89481

> 7.5 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix host memory disclosure on R2T for a read command

nvme_tcp_handle_r2t() does not check the direction of the request the
R2T refers to. A malicious controller can send an R2T for a READ and
the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the
H2CData header and nvme_tcp_try_send_data() sends the request's data
buffer. That buffer is the READ destination, so its contents go to the
controller.

The command then completes normally and nothing is logged.

Against a test controller that answers every READ with an R2T, a 4096
byte buffered read returned all 4096 bytes, split over two R2Ts. The
pages contained stale kernel data, including an array of struct page
pointers.

Reject an R2T for a request that is not a write.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Patch verfügbar (OSV)

- Kernel ≥ 6.1.188
- Kernel ≥ 6.6.157
- Kernel ≥ 6.12.109
- Kernel ≥ 6.18.50
- Kernel ≥ 7.2.4

## Referenzen

- <https://git.kernel.org/stable/c/49a4dcf57608ebf6432dbcb203ed25e7ed581445>
- <https://git.kernel.org/stable/c/bc4013c7cce58d46f792c8c87bc8c8318a70190e>
- <https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403>
- <https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c>
- <https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5>
- <https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-89481) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_