The Linux kernel's nvme_tcp_recv_data() function previously completed read requests once the current C2HData PDU was consumed without verifying that the total bytes received matched the requested length. Because struct nvme_tcp_request lacked a receive-side byte counter and queue->data_remaining was per queue, the kernel could incorrectly report a partial read as complete. This allowed a controller to respond to a 4096-byte read request with only 512 bytes, leaving the remaining buffer filled with stale data. The fix involved counting the bytes received and refusing to complete a read if the count does not match the requested length, specifically for REQ_OP_READ operations, by adding checks at the NVME_TCP_F_DATA_SUCCESS paths and in nvme_tcp_process_nvme_cqe().

User space applications relying on NVMe over TCP reads could receive incomplete data buffers with stale or uninitialized data, potentially leading to data corruption or incorrect application behavior. The vulnerability does not appear to allow arbitrary code execution or privilege escalation but compromises data integrity for read operations.

A fix has been implemented in the Linux kernel to verify that the number of bytes received matches the requested read length before completing the request. Users should apply the official kernel updates that include this patch. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory or Linux kernel mailing lists for the exact fixed versions and update accordingly.