CVE-2026-89973

A flaw was found in the Linux kernel's nvme-tcp component. A malicious or misconfigured NVMe controller can send a Controller to Host Data Protocol Data Unit (C2HData PDU) in response to a write command, which is not properly validated for data direction. This can trigger a kernel warning, leading to a controller reset and command failure. If the host system is configured to panic on kernel warnings, this vulnerability could result in a denial of service.

NVMe/TCP host handling accepts a C2HData PDU by command id and payload presence but did not verify that the matching request was a READ. A malicious or compromised NVMe/TCP controller can answer a WRITE request with C2HData and drive the host receive path into _copy_to_iter where a WARN_ON_ONCE is hit and the controller is reset. For the CVSS the PR:N is used because the attacker does not need a local account on the host when they control or can impersonate the controller endpoint. The issue is network reachable in storage fabric terms, but NVMe/TCP is normally deployed on isolated storage or data center networks rather than the public Internet. Impact is at least denial of service through repeated controller resets and may become a host kernel panic when panic_on_warn is enabled. No data copy succeeds and the patch context states that this is not memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.