A flaw in the Linux kernel nvme-tcp module allows a malicious controller to return incomplete data, resulting in the exposure of uninitialized memory to user space.

The nvme-tcp subsystem fails to verify that the total bytes received match the expected length of a read request, allowing an unauthenticated controller to trigger a successful completion for an incomplete transfer.

This vulnerability poses a significant risk to data confidentiality. Because the system improperly reports a complete read, user space applications receive memory pages containing residual, uninitialized data instead of the requested information. This could lead to the exposure of sensitive kernel memory or data from previous processes, potentially compromising security boundaries within the operating system. The CVSS score of 7.5 reflects the high impact on confidentiality in a network-accessible, low-complexity attack scenario.

Immediate Action: Update the Linux kernel to the versions specified in the OSV fixed packages (e.g., 6.12.109, 6.18.50, or 7.2.4) or the latest stable distribution kernel.

Proactive Monitoring: Monitor system logs for unusual NVMe transport errors and audit storage communication patterns for signs of unexpected data truncation or controller behavior.

Compensating Controls: Ensure that systems are configured to use trusted storage backends and restrict network access to NVMe-over-TCP targets to authorized, internal infrastructure only.

Public Exploit Available: Unknown.

The risk associated with this kernel-level memory exposure is high, particularly in virtualized or cloud environments where network storage is prevalent. Administrators should prioritize patching the kernel across all impacted nodes to prevent potential information leakage. Given the complexity of the flaw, applying the vendor-supplied security update is the only reliable method to ensure the integrity of data transfers and memory safety.