CVE-2026-89481
Description
A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) over TCP (nvme-tcp) component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer (R2T) command for a read request. The host system, failing to properly validate the request direction, will then send the contents of its read destination buffer to the controller. This can lead to the disclosure of stale kernel memory data, potentially revealing sensitive information.
Statement
This vulnerability is rated as Important because it allows a rogue or compromised network storage controller to leak host kernel memory over the network without requiring local privileges on the client. Red Hat Enterprise Linux systems are exposed only when acting as NVMe-oF TCP initiator clients that communicate with unverified or hostile storage targets. The attack surface is limited to environments actively using NVMe over TCP across untrusted network segments.
Mitigation
Prevent the nvme-tcp kernel module from loading if NVMe over TCP storage is not required on the system.
1. Add an entry to /etc/modprobe.d to prevent the module from loading:
# echo "install nvme-tcp /bin/true" >> /etc/modprobe.d/disable-nvme-tcp.conf
2. If the module is currently loaded and not in use by any storage target, unload it:
# modprobe -r nvme-tcp
Caveats:
Disabling this module prevents the system from connecting to NVMe over TCP block storage devices.
Warning:
Do not attempt to unload this module if active NVMe over TCP storage is mounted or in use, as doing so will cause I/O failure and potential data loss. If the module cannot be cleanly unloaded, a system restart is required for the change to take full effect. Additionally, restrict NVMe-oF connections to verified, trusted storage targets over isolated or encrypted network fabrics.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
