Building tools
that find the bugs.

nvmet-tcp · out-of-bounds write

nvmet_tcp_try_recv_pdu() derived the remaining payload length from the attacker-supplied header without bounding it against the 128-byte queue->pdu union. With a header digest negotiated, a second ICReq drives a write four bytes past the end of the buffer, letting a remote unauthenticated host corrupt adjacent kernel memory before the duplicate is rejected.

nvmet-tcp · use-after-free

When a data digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based transfer, the digest error handler drops the queue reference without marking the command complete — leaving it to be uninitialized a second time during teardown, a double percpu_ref_put() against a single percpu_ref_get().

nvmet-tcp · refcount underflow

In the digest error path, nvmet_req_uninit() was called unconditionally even when nvmet_req_init() had already failed and never taken a reference — causing a percpu_ref underflow, a use-after-free diagnostic, and a permanent workqueue deadlock.

nvmet-tcp · race condition

A race between ICReq handling and queue teardown allows a double kref_put() on an already-released queue — remotely triggerable without authentication.

nvmet-tcp · unsolicited H2CData PDU

nvmet_tcp_handle_h2c_data_pdu() validated only the TTAG, never that the target had actually solicited the data with an R2T. Sending H2CData ahead of the R2T completes a write command early, and a synchronous failure completes it again — the same command lands on resp_list twice, producing a self-referential llist node that trips a list_add BUG or wedges the nvmet_tcp workqueue.

nvme-tcp · NULL pointer dereference

A NULL pointer dereference triggered by out-of-order H2C_DATA PDUs, crashing storage servers remotely without authentication. Patched in mainline and backported to six stable releases.