Linux kernel NVMe-oF TCP host (nvme-tcp R2T PDU request-list handling): Nvme_tcp_handle_r2t() did not check that the

Impact

Nvme_tcp_handle_r2t() did not check that the request identified by an inbound Ready-to-Transfer PDU was not already on a list, so a malicious target sends a crafted R2T and injects a loop into the initiator's request list. The commit message says it plainly - a malicious R2T PDU. Every GPU node connected to that target is affected, and the corruption is in the block-layer request path, so it sits directly under the filesystem holding checkpoints and datasets.

Who can reach it

Remote, from the target side. A hostile or compromised NVMe/TCP target, or an attacker who can inject into an unencrypted NVMe/TCP session on the storage network.

What to do

Kernel update on compute nodes validating the request state in nvme_tcp_handle_r2t(). Consider NVMe/TCP over TLS on the storage path so R2T PDUs cannot be injected by an on-path attacker, and treat the storage network as a trust boundary rather than as infrastructure.

References