The Linux kernel nvme-tcp driver had a flaw where it accepted C2HData packets based only on blk_rq_payload_bytes(), ignoring blk_rq_nr_phys_segments(). For REQ_OP_WRITE_ZEROES commands, which have no physical segments but a non-zero byte count, this caused the receive side to copy data into an uninitialized iterator, leading to wild memory access and kernel crashes detected by KASAN. The patch added a check for req->data_len alongside req->curr_bio before accepting C2HData, aligning the receive side with the setup side and preventing invalid memory operations.

This vulnerability could cause kernel crashes due to wild memory access when processing certain NVMe TCP commands, potentially leading to denial of service. There is no indication of privilege escalation or data corruption beyond the crash. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by adding proper checks before accepting C2HData. Users should update to a kernel version that includes the commit 25e5cb780e62 or later containing this fix. Patch status is not explicitly confirmed in the input data; therefore, verify with the official Linux kernel advisory or source repository for the exact fixed versions and apply updates accordingly.