CVE-2026-52989

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0034

Probability of exploitation

0.26%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-390 CWE-390

References

Other References

https://git.kernel.org/stable/c/046fa5c72d15cd8e2d592e275697ea399d8f76b0 https://git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453c https://git.kernel.org/stable/c/c2a11441538bdbbc5aa003f190995eba93a89b88 https://git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3 https://git.kernel.org/stable/c/ea8e356acb165cb1fd75537a52e1f66e5e76c538 https://git.kernel.org/stable/c/f9204a2b78dd18374d3bcf9bf93d9021ce22de1b https://access.redhat.com/security/cve/CVE-2026-52989 https://bugzilla.redhat.com/show_bug.cgi?id=2492443 https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52989.json

Frequently Asked Questions

What is CVE-2026-52989? +

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2026-52989? +

CVE-2026-52989 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0034, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-52989? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-53434 9.1

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue …

CVE-2024-49841 7.8

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

CVE-2025-46367 7.8

Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. A …

CVE-2024-27919 7.5

Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable …

CVE-2025-26465 6.8

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a …

CVE-2025-27039 6.6

Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.