CVE-2026-52989 — Kernel
CRITICALCVE-2026-52989 is a critical-severity (CVSS 9.8) vulnerability in Kernel. A fix is available for Kernel — see the affected versions and patch details below.
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-52989 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 380,526 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
KernelReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Linux packages — download data is not available via public APIs for these ecosystems.
Description
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized.
Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator.
Fix this by shifting the error handling responsibility to the callers.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐧Linux | Kernel | ≥ 6.2.0&&< 6.1.175 | 6.1.175 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Kernel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Kernel to 6.1.175 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-52989 is resolved across your whole dependency graph.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
For Red Hat Enterprise Linux, mitigation for this issue is not applicable as the product is not affected. For Red Hat In-Vehicle OS, if the NVM Express over TCP (nvmet-tcp) functionality is not required, the `nvmet_tcp` kernel module can be prevented from loading. To do this, create a file named `/etc/modprobe.d/disable-nvmet-tcp.conf` with the following content: `install nvmet_tcp /bin/true` `blacklist nvmet_tcp` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Disabling this module may impact storage functionality if NVMe over TCP is in use.Source: Red Hat security advisory for CVE-2026-52989 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-52989 in your dependencies?
Find it across Linux, including transitive dependencies.