Skip to main content

Linux Kernel EUVDEUVD-2026-38857

| CVE-2026-52989 CRITICAL
Detection of Error Condition Without Action (CWE-390)
2026-06-24 Linux GHSA-m4w6-2g7f-9j5p
Linux Buffer Overflow Red Hat Suse
9.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

Reaching the H2C handler needs an established association on a deliberately enabled NVMe-oF TCP target (PR:L) and a specifically malformed PDU (AC:H); realistic impact is mainly DoS (A:H) with uncertain memory disclosure/corruption (C:L/I:L).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:44 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
CRITICAL 9.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized.

Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator.

Fix this by shifting the error handling responsibility to the callers.

AnalysisAI

Memory-safety flaw in the Linux kernel's NVMe-over-TCP target driver (nvmet-tcp) lets a connected initiator drive the kernel into reading received network data through an uninitialized iov_iter. Because nvmet_tcp_build_pdu_iovec() reported out-of-bounds PDU length/offset only via a fatal-error side effect while returning void, callers such as nvmet_tcp_handle_h2c_data_pdu() continued and advanced the receive state machine over an uninitialized cmd->recv_msg.msg_iter, leading to memory corruption or denial of service. NVD rates this 9.8 (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), but EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; it is not in CISA KEV.

Technical ContextAI

The affected component is nvmet-tcp, the in-kernel NVMe-over-Fabrics target (storage server) transport that exposes NVMe namespaces over TCP. During PDU processing the helper nvmet_tcp_build_pdu_iovec() validates the data length and offset of an incoming Host-to-Controller (H2C) data PDU; on an out-of-bounds value it called nvmet_tcp_fatal_error() but, returning void, gave callers no error signal. Callers then set queue->rcv_state = NVMET_TCP_RECV_DATA and let the socket receive loop copy inbound bytes into cmd->recv_msg.msg_iter, which was never initialized. The root cause is an unchecked/swallowed error return feeding a use-of-uninitialized iterator (a CWE-457/CWE-908-class issue; the tag labels it a buffer-overflow-style memory corruption, though the upstream CWE field is N/A). CPE data points only at cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel tree.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (and the 6.19 mainline), per the EUVD patch list; apply your distribution's backported kernel update once it ships, referencing the upstream commits at git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453c and git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3. Until patched, the most effective compensating control is to disable the NVMe-oF TCP target where it is not required (unload/blacklist the nvmet_tcp module or tear down the TCP port in nvmetcli), which fully removes the attack surface at the cost of disabling NVMe-over-TCP export on that host. If the target must stay online, restrict the NVMe/TCP port (default 4420) with firewall rules so only trusted initiator hosts can connect, and enable NVMe-oF in-band authentication (DH-HMAC-CHAP) plus host-NQN allow-lists to limit which initiators can establish an association - these reduce, but do not eliminate, exposure from authorized-but-malicious or compromised initiators.

Same weakness CWE-390 – Detection of Error Condition Without Action

View all
CVE-2025-26465 MEDIUM
6.8
CVE-2021-40391 CRITICAL POC
9.8
CVE-2019-5051 HIGH POC
8.8
CVE-2024-12086 MEDIUM POC
6.8
CVE-2024-49841 HIGH
7.8
CVE-2024-30255 HIGH
7.5
CVE-2024-27919 HIGH
7.5
CVE-2025-25204 MEDIUM
6.3

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

EUVD-2026-38857 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy