CVE-2026-89482

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1

Description An issue exists in the nvme-tcp driver where the system incorrectly accepts C2HData based solely on the blk rq payload bytes() function. For REQ OP WRITE ZEROES operations, which lack physical segments but have non-zero bytes, the receive gate allows C2HData to pass through. This leads the nvme tcp recv data() function to copy data into a residual iterator left by a previous command on the same tag, potentially causing a wild-memory-access crash. This was demonstrated via a KASAN report showing a memory write error in the copy to iter() function.

Recommendations Update the Linux kernel to version 7.2.6-1.1 or later.