Search: CVE-2026-89481

A vulnerability in the Linux kernel's nvme-tcp subsystem allows a malicious NVMe controller to cause host memory disclosure by sending an R2T (Ready To Transfer) for a read command. The kernel does not verify the direction of the request referenced by the R2T, resulting in the host sending stale kernel memory contents to the controller. This issue affects multiple specific Linux kernel versions and has been resolved by rejecting R2Ts for requests that are not writes.