CVE-2026-89968

A flaw was found in the nvmet-tcp component of the Linux kernel. A remote attacker can exploit this vulnerability by sending an unsolicited H2CData PDU (Protocol Data Unit) before the target transmits an R2T (Ready To Transfer) for a write command. This can cause the command to be completed twice, leading to a kernel bug or a soft-lockup. The most significant consequence is a Denial of Service (DoS) condition, making the system unresponsive.

An unsolicited H2CData PDU in the NVMe/TCP target path can be accepted before the target has sent an R2T for the command. A remote host can submit a write command that takes the R2T path and then send H2CData for the same tag before R2T is transmitted, causing early command completion and a later second completion on an error path. This can add the same command to the response list twice and create a self referential list node, resulting in a kernel BUG with CONFIG_DEBUG_LIST or a wedged nvmet_tcp workqueue and soft lockup without it. For the CVSS the PR:N is used for the paranoid score because an allow_any_host subsystem can be reached without authentication once the attacker has access to the NVMe/TCP target network. The issue is network reachable inside the storage fabric, but NVMe/TCP targets are usually deployed on isolated storage or data center networks rather than the public Internet. Impact is at least denial of service via kernel crash or workqueue lockup and in worst case may allow limited confidentiality or integrity impact due to kernel list state corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.