# nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

CVE record · `CVE-2026-52989`

- **Identifiers:** `CVE-2026-52989`
- **State:** Confirmed
- **Severity:** CVSS 9.8 Critical
- **Critical:** Yes: CVSS 9+
- **CNA:** Linux
- **Weakness (CWE):** [CWE-390](https://cwe.mitre.org/data/definitions/390.html)
- **Tags:** [CWE-390](https://agentprime.io/advisories/tag/cwe-390.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 24 Jun 2026
- **Updated:** 24 Aug 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 24 Jun 2026, 16:29 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Critical

Critical, because:

- CVSS score 9.8: 9.0 or more.

How we decide what’s critical: <https://agentprime.io/advisories/critical.md>

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `1385be357e8acd09b36e026567f3a9d5c61139de to before 3df42a854686fa06484e37ac1a3931c8e3e3453c` (git)
  - affected: `dca1a6ba0da9f472ef040525fab10fd9956db59f to before d7c8f95f599b3b38a717d2e771c3f8c174f657c3` (git)
  - affected: `19672ae68d52ff75347ebe2420dde1b07adca09f to before f9204a2b78dd18374d3bcf9bf93d9021ce22de1b` (git)
  - affected: `ab200d71553bdcf4de554a5985b05b2dd606bc57 to before c2a11441538bdbbc5aa003f190995eba93a89b88` (git)
  - affected: `52a0a98549344ca20ad81a4176d68d28e3c05a5c to before 046fa5c72d15cd8e2d592e275697ea399d8f76b0` (git)
  - affected: `52a0a98549344ca20ad81a4176d68d28e3c05a5c to before ea8e356acb165cb1fd75537a52e1f66e5e76c538` (git)
  - affected: `043b4307a99f902697349128fde93b2ddde4686c` (git)
  - affected: `42afe8ed8ad2de9c19457156244ef3e1eca94b5d` (git)
  - affected: `6.1.163 to before 6.1.175` (semver)
  - affected: `6.6.124 to before 6.6.141` (semver)
  - affected: `6.12.70 to before 6.12.91` (semver)
  - affected: `6.18.10 to before 6.18.33` (semver)
  - and 2 more
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `6.19`
  - unaffected: `before 6.19` (semver)
  - unaffected: `6.1.175 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.141 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.91 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.33 to 6.18.*, inclusive` (semver)
  - unaffected: `7.0.10 to 7.0.*, inclusive` (semver)
  - unaffected: `7.1 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 9.8 Critical, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux) (used for this record)
- 7.1 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H`, from ADP (redhat-SADP)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0036, the 29th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 24 Jun 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-52989](https://www.cve.org/CVERecord?id=CVE-2026-52989)
- [NVD: CVE-2026-52989](https://nvd.nist.gov/vuln/detail/CVE-2026-52989)

### References from the CNA

- <https://git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453c>
- <https://git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3>
- <https://git.kernel.org/stable/c/f9204a2b78dd18374d3bcf9bf93d9021ce22de1b>
- <https://git.kernel.org/stable/c/c2a11441538bdbbc5aa003f190995eba93a89b88>
- <https://git.kernel.org/stable/c/046fa5c72d15cd8e2d592e275697ea399d8f76b0>
- <https://git.kernel.org/stable/c/ea8e356acb165cb1fd75537a52e1f66e5e76c538>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-52989>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-52989/>. Everything for agents: <https://agentprime.io/llms.txt>.