CVE-2026-89481

A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) over TCP (nvme-tcp) component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer (R2T) command for a read request. The host system, failing to properly validate the request direction, will then send the contents of its read destination buffer to the controller. This can lead to the disclosure of stale kernel memory data, potentially revealing sensitive information.

This vulnerability is rated as Important because it allows a rogue or compromised network storage controller to leak host kernel memory over the network without requiring local privileges on the client. Red Hat Enterprise Linux systems are exposed only when acting as NVMe-oF TCP initiator clients that communicate with unverified or hostile storage targets. The attack surface is limited to environments actively using NVMe over TCP across untrusted network segments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the nvme-tcp kernel module from loading if NVMe over TCP storage is not required on the system.

1. Add an entry to /etc/modprobe.d to prevent the module from loading:

echo "install nvme-tcp /bin/true" >> /etc/modprobe.d/disable-nvme-tcp.conf

2. If the module is currently loaded and not in use by any storage target, unload it:

modprobe -r nvme-tcp

Caveats: Disabling this module prevents the system from connecting to NVMe over TCP block storage devices.

Warning: Do not attempt to unload this module if active NVMe over TCP storage is mounted or in use, as doing so will cause I/O failure and potential data loss. If the module cannot be cleanly unloaded, a system restart is required for the change to take full effect. Additionally, restrict NVMe-oF connections to verified, trusted storage targets over isolated or encrypted network fabrics.