CVE-2026-52989

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers<br /> <br /> Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds<br /> PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd-&gt;queue)<br /> and returns early. However, because the function returns void, the<br /> callers are entirely unaware that a fatal error has occurred and<br /> that the cmd-&gt;recv_msg.msg_iter was left uninitialized.<br /> <br /> Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly<br /> overwrite the queue state with queue-&gt;rcv_state = NVMET_TCP_RECV_DATA<br /> Consequently, the socket receiving loop may attempt to read incoming<br /> network data into the uninitialized iterator.<br /> <br /> Fix this by shifting the error handling responsibility to the callers.