Linux kernel NVMe-oF TCP target (nvmet-tcp, unpropagated PDU iovec build errors): Nvmet_tcp_build_pdu_iovec() detects

Impact

Nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, flags a fatal error - and returns void. The caller never learns, sets the queue into receive-data state anyway, and the socket loop then reads attacker-supplied network bytes into an uninitialised iov_iter. A remote initiator that sends a malformed PDU length therefore steers kernel writes through an iterator whose contents are whatever was on the stack. The kernel CNA rates it network, unauthenticated, full CIA, and the reasoning is visible in the fix.

Who can reach it

Remote, unauthenticated, by sending a PDU with an out-of-range length or data offset to the nvmet-tcp listener.

What to do

Kernel update making the iovec builder return an error and the callers honour it. Same network containment applies: the storage target's listener must be unreachable from tenant networks.

References