EUVD-2026-76387
GHSA-fmg2-x8fr-fw62
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H because exploiting requires attacker control or MITM of an NVMe-TCP storage controller endpoint, not trivial network access; C:H for silent kernel memory disclosure.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: fix host memory disclosure on R2T for a read command
nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends the request's data buffer. That buffer is the READ destination, so its contents go to the controller.
The command then completes normally and nothing is logged.
Against a test controller that answers every READ with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained stale kernel data, including an array of struct page pointers.
Reject an R2T for a request that is not a write.
AnalysisAI
Kernel memory disclosure in the Linux kernel's nvme-tcp driver allows a malicious or compromised NVMe-TCP storage controller to exfiltrate arbitrary stale kernel memory pages from a connected host. The flaw in nvme_tcp_handle_r2t() - which fails to validate that an incoming R2T (Ready to Transfer) PDU corresponds to a WRITE command - causes the host to respond to R2T PDUs targeting READ commands by transmitting the READ destination buffer (uninitialized kernel memory) back to the controller via H2CData PDUs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target host uses the Linux kernel nvme-tcp driver (CONFIG_NVME_TCP=y/m) and has an active NVMe-TCP connection to a controller. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5) reflects the ease of exploitation once an attacker occupies a malicious controller position, but AC:L understates the real-world attacker prerequisite: the host must be connecting to a rogue or MITM'd NVMe-TCP storage controller. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 as applicable to your distribution's kernel branch; upstream fix commits are published at git.kernel.org/stable (see references). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems using NVMe-TCP storage devices and document their current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today