CVE-2026-89973

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the nvme tcp handle c2h data() function where the system fails to verify if a command requested a data read when processing a C2HData PDU. A malicious controller can respond to a write command with C2HData, leading the execution to nvme tcp recv data() and subsequently triggering a kernel warning in the copy to iter() function. While this does not result in memory corruption, it allows a controller to trigger a kernel warning at will, which can lead to a system crash on hosts configured with panic on warn.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.