Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-89969: Linux kernel can be corrupted by crafted network storage data
CVE-2026-89969 · published 1 month ago
Summary
The Linux kernel component that handles NVMe over TCP may write beyond the end of its internal buffer when it receives a specially crafted packet. An unauthenticated remote system could use this to corrupt kernel memory, potentially affecting system stability. Apply the latest kernel updates from your Linux distribution to fix the issue.
What to do
- Update debian linux to version 7.2.6-1.
- Update linux kernel to version 7.2.5.
- Update bellsoft linux-lts to version 6.18.53-r0.
- Update debian linux to version 6.12.111-1.
- Update bellsoft linux-lts to version 6.12.111-r0.
- Update debian linux-6.12 to version 6.12.111-1~deb12u1.
- Update bellsoft linux-lts to version 6.1.189-r0.
- Update debian linux to version 6.1.190-1.
- Update linux linux to version a3f0bcfbaf3312a5754d1ce020a07d394669eb25 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:14 | debian | linux |
< 7.2.6-1 Fix: upgrade to 7.2.6-1
|
| – | linux | linux |
< a3f0bcfbaf3312a5754d1ce020a07d394669eb25 5.0 |
| Linux | linux | kernel |
>= 6.19.0, < 7.2.5 Fix: upgrade to 7.2.5
|
| Debian:12 | debian | linux |
< 6.1.190-1 Fix: upgrade to 6.1.190-1
|
| Ubuntu:Pro:14.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-lts-xenial | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-aws-hwe | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-oracle | All versions |
| Ubuntu:Pro:FIPS:16.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-aws-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-azure-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-azure-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-gcp-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-gcp-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-hwe-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-ibm-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-oracle-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-raspi-5.4 | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-aws-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-fde-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
Showing 50 of 178. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-gcp-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-hwe-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-ibm | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-ibm-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-intel-iotg-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-iot | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-lowlatency-hwe-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-nvidia-tegra-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-oracle-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-raspi | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-riscv-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-xilinx-zynqmp | All versions |
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-ibm-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iotg | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra-igx | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime-6.8 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-lowlatency | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-xilinx | All versions |
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.14 | All versions |
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.17 | All versions |
| Ubuntu:26.04:LTS | canonical | linux-nvidia-bos | All versions |
| Ubuntu:26.04:LTS | canonical | linux-oem-7.0 | All versions |
| Alpaquita:23 | bellsoft | linux-lts |
>= 6.1.182-r0 >= 6.1.182-r0, < 6.1.189-r0 Fix: upgrade to 6.1.189-r0
|
| Alpaquita:25 | bellsoft | linux-lts |
>= 6.12.103-r0 >= 6.12.103-r0, < 6.12.111-r0 Fix: upgrade to 6.12.111-r0
|
| Alpaquita:stream | bellsoft | linux-lts |
>= 6.18.46-r0 >= 6.18.46-r0, < 6.18.53-r0 Fix: upgrade to 6.18.53-r0
|
| Debian:13 | debian | linux |
< 6.12.111-1 Fix: upgrade to 6.12.111-1
|
| Debian:12 | debian | linux-6.12 |
< 6.12.111-1~deb12u1 Fix: upgrade to 6.12.111-1~deb12u1
|
| Ubuntu:24.04:LTS | canonical | linux-vmware | All versions |
Original advisory text
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining payload length as queue->left = hdr->hlen - queue->offset + hdgst; and reads that many more bytes into &queue->pdu + queue->offset, without ever bounding the result against sizeof(queue->pdu). A struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the union. Once a header digest has been negotiated (hdgst = 4), a second ICReq passes the hlen == nvmet_tcp_pdu_size() check but yields queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the 128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and queue->data_digest. Those bytes are attacker-controlled (an ICReq carries no digest), and the duplicate ICReq is only rejected later, after the overflow. A remote unauthenticated host can thus corrupt kernel memory adjacent to the receive buffer. Reject any PDU whose declared length would read past the end of queue->pdu before the second recv.
References
- https://git.kernel.org/stable/c/d95d342bc0ea82dc79e6362b2f1f997431750e4c URL
- https://git.kernel.org/stable/c/14cc5a7e77731497d5bea70f3bb05df7eda982e4 URL
- https://git.kernel.org/stable/c/3a385e0c39efbe34db8edd95900c123113ae3450 URL
- https://git.kernel.org/stable/c/4f84d42c53c49557fb1ef285c683b0a81b576c74 URL
- https://git.kernel.org/stable/c/58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6 URL
- https://git.kernel.org/stable/c/a3f0bcfbaf3312a5754d1ce020a07d394669eb25 URL
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89969... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-89969 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-89969 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-89969 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-89969 Third Party Advisory
- https://git.kernel.org/linus/14cc5a7e77731497d5bea70f3bb05df7eda982e4 Third Party Advisory
- https://git.kernel.org/stable/c/cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca URL
- https://git.kernel.org/stable/c/dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-89969 Vendor Advisory
Severity
9.8
Critical
Timeline
Published16 Sep 2026
Updated22 Oct 2026
First seen16 Sep 2026
Sources
CVE-2026-89969 · NVD
CVE-2026-89969 · MITRE
CVE-2026-89969 · OSV
DEBIAN-CVE-2026-89969 · OSV
UBUNTU-CVE-2026-89969 · OSV
BELL-CVE-2026-89969 · OSV
Track software like this
Free during beta