A vulnerability in the Linux kernel NVMe-TCP driver enables unauthenticated remote attackers to perform sensitive kernel memory disclosure via a malicious controller.

The function nvme_tcp_handle_r2t fails to verify the command direction, allowing a malicious NVMe controller to send a Ready-to-Transfer (R2T) PDU for read commands. This forces the host to transmit its own kernel memory buffers back to the controller, which can include sensitive data such as page pointers.

Successful exploitation allows an adversary to exfiltrate raw kernel memory, which may contain sensitive information including cryptographic keys, credentials, or internal system structures. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to data confidentiality, especially in environments utilizing untrusted or multi-tenant NVMe-over-Fabrics storage controllers.

Immediate Action: Update the Linux kernel to the versions specified in the upstream stable releases, specifically 6.12.109, 6.18.50, or 7.2.4 or later.

Proactive Monitoring: Monitor storage subsystem logs for unusual NVMe-TCP command patterns or unexpected communication volume originating from storage controllers.

Compensating Controls: Restrict access to NVMe-over-Fabrics targets to trusted, authenticated, and hardened storage controllers to prevent unauthorized interaction with the host driver.

Public Exploit Available: Unknown.

This vulnerability represents a critical risk to kernel integrity and data confidentiality. Organizations utilizing NVMe-TCP for high-performance storage connectivity must prioritize patching their kernel versions. If immediate patching is not feasible, ensure that all storage controllers are sourced from verified, trusted vendors and operate within secured network segments.