The Linux kernel nvme-tcp driver had a vulnerability where the function nvme_tcp_handle_r2t() failed to check the direction of the request associated with an R2T. A malicious NVMe controller could send an R2T for a read command, causing the host to respond with data from the read destination buffer, which contained stale kernel memory including sensitive data structures. This memory disclosure occurred without logging or error. The fix involves rejecting R2Ts that do not correspond to write requests.

An attacker controlling a malicious NVMe controller can exploit this vulnerability to read stale kernel memory from the host system. This could lead to disclosure of sensitive kernel data structures, potentially aiding further attacks or information leakage. The command completes normally without detection, making exploitation stealthy.

A fix is available that rejects R2T messages for requests that are not writes, preventing the memory disclosure. Users should apply the official Linux kernel patches that address this issue. Since no vendor advisory or patch links were provided, check the Linux kernel mailing lists or official repositories for the relevant patch and update accordingly.