In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that the target has actually solicited that data by sending an R2T for the command. A remote host can abuse this. It submits a write command that takes the R2T path and, before the target transmits the R2T, sends an H2CData PDU for that command's tag. The data completes the command early, and when the command then fails synchronously (e.g. a length mismatch caught by nvmet_check_transfer_len()), it is completed a second time. Each completion calls nvmet_tcp_queue_response(), so the same command is added to queue->resp_list twice while it is still linked; the second llist_add() makes the node point to itself (lentry->next == lentry). nvmet_tcp_process_resp_list() then walks that self-referential node and adds the command to resp_send_list twice. With CONFIG_DEBUG_LIST this trips the "list_add double add" check (kernel BUG); without it the loop never terminates and the nvmet_tcp workqueue wedges (soft-lockup). It is remotely triggerable and needs no authentication on an allow_any_host subsystem. Track whether an R2T has been transmitted for a command and reject an H2CData PDU that arrives before it. The flag is cleared on command reuse (nvmet_tcp_get_cmd() zeroes cmd->flags) and stays set across the multiple H2CData PDUs of a single solicited transfer.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData
    PDUs nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU after only checking that its TTAG is a valid
    in-range command index and that the command's data buffers are mapped. It never checks that the target has
    actually solicited that data by sending an R2T for the command. A remote host can abuse this. It submits a
    write command that takes the R2T path and, before the target transmits the R2T, sends an H2CData PDU for
    that command's tag. The data completes the command early, and when the command then fails synchronously
    (e.g. a length mismatch caught by nvmet_check_transfer_len()), it is completed a second time. Each
    completion calls nvmet_tcp_queue_response(), so the same command is added to queue->resp_list twice while
    it is still linked; the second llist_add() makes the node point to itself (lentry->next == lentry).
    nvmet_tcp_process_resp_list() then walks that self-referential node and adds the command to resp_send_list
    twice. With CONFIG_DEBUG_LIST this trips the "list_add double add" check (kernel BUG); without it the loop
    never terminates and the nvmet_tcp workqueue wedges (soft-lockup). It is remotely triggerable and needs no
    authentication on an allow_any_host subsystem. Track whether an R2T has been transmitted for a command and
    reject an H2CData PDU that arrives before it. The flag is cleared on command reuse (nvmet_tcp_get_cmd()
    zeroes cmd->flags) and stays set across the multiple H2CData PDUs of a single solicited transfer.
    (CVE-2026-89968)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nvmet-tcp: reject unsolicited H2CData PDUs nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU after     only checking that its TTAG is a valid in-range command index and that the command's data buffers are     mapped. It never checks that the target has actually solicited that data by sending an R2T for the     command. A remote host can abuse this. It submits a write command that takes the R2T path and, before the     target transmits the R2T, sends an H2CData PDU for that command's tag. The data completes the command     early, and when the command then fails synchronously (e.g. a length mismatch caught by     nvmet_check_transfer_len()), it is completed a second time. Each completion calls     nvmet_tcp_queue_response(), so the same command is added to queue->resp_list twice while it is still     linked; the second llist_add() makes the node point to itself (lentry->next == lentry).
    nvmet_tcp_process_resp_list() then walks that self-referential node and adds the command to resp_send_list     twice. With CONFIG_DEBUG_LIST this trips the list_add double add check (kernel BUG); without it the loop     never terminates and the nvmet_tcp workqueue wedges (soft-lockup). It is remotely triggerable and needs no     authentication on an allow_any_host subsystem. Track whether an R2T has been transmitted for a command and     reject an H2CData PDU that arrives before it. The flag is cleared on command reuse (nvmet_tcp_get_cmd()     zeroes cmd->flags) and stays set across the multiple H2CData PDUs of a single solicited transfer.
    (CVE-2026-89968)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364137	Oracle Linux 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
472587	Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.624.2	Tenable Cloud Security	Google COS Security Checks	Local	high
472587	Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.624.2	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
469816	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8	Tenable Cloud Security	Google COS Security Checks	Local	high
469816	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
469029	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7	Tenable Cloud Security	Google COS Security Checks	Local	high
469029	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
346542	Linux Distros Unpatched Vulnerability : CVE-2026-89968	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-89968

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high