CVE-2026-52989 Details
Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.
A vulnerability in the Linux kernel's NVMe over TCP implementation allows for improper error handling in the command processing. When the function 'nvmet_tcp_build_pdu_iovec()' encounters an out-of-bounds PDU length or offset, it signals a fatal error but does not inform the calling functions. This oversight leaves the command's message iterator uninitialized, potentially leading to undefined behavior when the socket receiving loop attempts to read network data into it. The issue arises in the NVMe-TCP driver, specifically in versions of the Linux kernel prior to the latest patch.
Users can upgrade to the latest version of the Linux kernel stable release, where this vulnerability has been addressed. Instructions for downloading the latest stable kernel can be found on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-52989 | redhat-SADP | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2492443 | redhat-SADP | Issue TrackingThird Party Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52989.json | redhat-SADP | Third Party Advisory |
| https://git.kernel.org/stable/c/046fa5c72d15cd8e2d592e275697ea399d8f76b0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453c | kernel.org | Patch |
| https://git.kernel.org/stable/c/c2a11441538bdbbc5aa003f190995eba93a89b88 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ea8e356acb165cb1fd75537a52e1f66e5e76c538 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f9204a2b78dd18374d3bcf9bf93d9021ce22de1b | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
| CWE-390 | Detection of Error Condition Without Action | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.10.250, < 5.11 >= 5.15.200, < 5.16 >= 6.1.163, < 6.1.175 >= 6.6.124, < 6.6.141 >= 6.12.70, < 6.12.91 >= 6.18.10, < 6.18.33 >= 6.19.1, < 7.0.10 6.19 - 7.1 rc1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 21, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 24, 2026 | New CVE Received | kernel.org |