In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: fix host memory disclosure on R2T for a read command
nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends the request's data buffer. That buffer is the READ destination, so its contents go to the controller.
The command then completes normally and nothing is logged.
Against a test controller that answers every READ with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained stale kernel data, including an array of struct page pointers.
Reject an R2T for a request that is not a write.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-headersUpgrade kernel-rt-coreUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libs-develUpgrade kernel-cross-headersUpgrade bpftoolUpgrade kernel-debug-develUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-modules-extraUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-coreUpgrade kernel-develUpgrade kernel-debug-coreUpgrade python3-perfUpgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-docUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade perfUpgrade kernel-debugUpgrade kernel-zfcpdump-core | Oct 11, 2026 | Oct 5, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Sep 30, 2026 | Sep 11, 2026 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Sep 21, 2026 | Sep 11, 2026 |
| Rocky_linux | — | Upgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modulesUpgrade kernel-coreUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-debuginfo-common-s390xUpgrade libperfUpgrade bpftoolUpgrade rvUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-tools-libsUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-tools-libs-develUpgrade kernel-uki-virtUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade bpftool-debuginfoUpgrade kernel-modules-extra-matchedUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade perf-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rtUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade python3-perf-debuginfoUpgrade libperf-debuginfoUpgrade kernelUpgrade kernel-debug-develUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade rtlaUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-coreUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade perfUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade kernel-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-debug-uki-virtUpgrade kernel-rt-develUpgrade kernel-zfcpdump-develUpgrade python3-perfUpgrade kernel-rt-debug-devel | Sep 28, 2026 | Sep 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 21, 2026 | Sep 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub