CVE-2026-52989: Linux kernel nvmet-tcp: uninitialized iterator after PDU bounds error
CVE-2026-52989 affects the nvmet-tcp NVMe over TCP target in the Linux kernel. When a PDU length or offset is out of bounds, the error is not reported to callers, which may leave a receive iterator uninitialized. The record carries a CNA-assigned CVSS 3.1 score of 9.8 and lists stable-branch patches.
Overview
CVE-2026-52989 is a flaw in the nvmet-tcp target driver of the Linux kernel, classified as CWE-908 (Use of Uninitialized Resource). When the PDU iovec builder detects an out-of-bounds length or offset, it signals a fatal error but returns void, so callers continue processing and can leave the receive iterator uninitialized. The upstream change moves error handling responsibility to the callers, as described in the NVD entry.
Impact
The record describes a condition in which the socket receive loop may attempt to read incoming network data into an uninitialized iterator. The CNA-assigned CVSS 3.1 base score is 9.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network reachability without privileges or user interaction and high impact on confidentiality, integrity and availability. A second provider listed in the record gives a CVSS 3.1 score of 7.1.
- Inference: the vector suggests the flaw may be reachable over the network on systems that expose an NVMe over TCP target, but the sources do not confirm a specific exploitation path.
- Unknown: the exact memory-safety consequences on each kernel build are not described in the sources consulted.
Affected products and versions
The record lists the product as Linux Linux Kernel with these ranges and versions:
- from 5.10.250 up to but not including 5.11
- from 5.15.200 up to but not including 5.16
- from 6.1.163 up to but not including 6.1.175
- from 6.6.124 up to but not including 6.6.141
- from 6.12.70 up to but not including 6.12.91
- from 6.18.10 up to but not including 6.18.33
- from 6.19.1 up to but not including 7.0.10
- version 6.19
- version 7.1-rc1
The stable commits linked in the Red Hat tracking entry and in the patch references are the reference points for checking your own kernel build. The record does not state a single fixed version for each branch.
Exploitation status
The record marks the CVE as not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted. The record also contains no EPSS value.
Remediation and mitigation
- Update to a kernel build from your distribution or from the upstream stable branch that includes the patches listed in the references, such as the upstream commit 046fa5c7.
- Confirm the running kernel version against the affected ranges above, and check vendor advisories for backported fixes, since distribution kernels may differ from upstream version numbers.
- Inference: where patching cannot be applied immediately, reduce exposure by limiting which hosts can reach NVMe over TCP target ports and by disabling the target service if it is not needed.
Detection guidance
- Inventory hosts running the affected kernel ranges and identify those that load the nvmet-tcp module or run an NVMe over TCP target.
- Review kernel logs for errors reported by the nvmet-tcp component, and treat unexpected target-side errors as a prompt to verify patch status.
- Monitor network-facing NVMe over TCP endpoints for unusual connection patterns, recognizing that this is a general practice and not a signature confirmed by the sources.
Limitations of the available information
The record provides a description, CVSS data from two providers, CWE classification, and a list of stable commits and vendor tracking references. It does not provide EPSS data, SSVC data, a proof of concept, a per-branch fixed version statement, or details of exploit conditions beyond the description. Consult the linked commits and vendor advisories for authoritative remediation status.
Frequently asked questions
What is the core problem in CVE-2026-52989?
The PDU iovec builder in the nvmet-tcp driver detects out-of-bounds values and reports a fatal error, but returns void, so callers do not know the iterator was left uninitialized and may continue processing.
Is this CVE known to be exploited in the wild?
The record indicates the CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.
What should administrators do first?
Check whether hosts run the affected kernel ranges or the nvmet-tcp target, then apply the stable or distribution kernel updates that include the listed patches.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.