CVE-2023-52454: nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-23 · updated 2026-08-04
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length If the host sends an H2CData command with an invalid DATAL, the kernel may crash in nvmet_tcp_build_pdu_iovec(). Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp] Call trace: process_one_work+0x174/0x3c8 worker_thread+0x2d0/0x3e8 kthread+0x104/0x110 Fix the bug by raising a fatal error if DATAL isn't coherent with the packet size. Also, the PDU length should never exceed the MAXH2CDATA parameter which has been communicated to the host in nvmet_tcp_handle_icreq().

Affected products

Linux kernel: from 5.0.0 before 5.4.268; from 5.5.0 before 5.10.209; from 5.11.0 before 5.15.148; from 5.16.0 before 6.1.75; from 6.2.0 before 6.6.14; from 6.7.0 before 6.7.2 — fixed in 5.10.209, 5.15.148, 5.4.268, 6.1.75, 6.6.14, 6.7.2

How to fix

Upgrade to a fixed version: Linux kernel 5.10.209, 5.15.148, 5.4.268, 6.1.75. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-52454 or the next vulnerability affects your stack