[SRU][Q/J][PATCH 0/2] CVE-2026-52989

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-52989

[ Impact ]

When nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset,
it triggers a fatal error and returns early, but because the function returns
void, its callers are unaware the error occurred and that
cmd->recv_msg.msg_iter was left uninitialized. Callers such as
nvmet_tcp_handle_h2c_data_pdu() proceed to overwrite the queue state with
NVMET_TCP_RECV_DATA, causing the socket receive loop to read incoming network
data into an uninitialized iterator. This affects the NVMe-over-TCP target and
can be remotely triggered, with a CVSS score of 9.8.

[ Fix ]

questing: clean cherry-pick
jammy: backported with AI-assisted adaptation
focal: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix could affect the nvmet-tcp (NVMe target over TCP)
subsystem, potentially causing incorrect error handling of H2C data PDUs or
premature connection teardown for otherwise valid traffic.