In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds
PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue)
and returns early. However, because the function returns void, the
callers are entirely unaware that a fatal error has occurred and
that the cmd->recv_msg.msg_iter was left uninitialized.

Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly
overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA
Consequently, the socket receiving loop may attempt to read incoming
network data into the uninitialized iterator.

Fix this by shifting the error handling responsibility to the callers.

https://git.kernel.org/stable/c/046fa5c72d15cd8e2d592e275697ea399d8f76b0

https://git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453c

https://git.kernel.org/stable/c/c2a11441538bdbbc5aa003f190995eba93a89b88

https://git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3

https://git.kernel.org/stable/c/ea8e356acb165cb1fd75537a52e1f66e5e76c538

https://git.kernel.org/stable/c/f9204a2b78dd18374d3bcf9bf93d9021ce22de1b

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/target/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1385be357e8acd09b36e026567f3a9d5c61139de","lessThan":"3df42a854686fa06484e37ac1a3931c8e3e3453c","versionType":"git","status":"affected"},{"version":"dca1a6ba0da9f472ef040525fab10fd9956db59f","lessThan":"d7c8f95f599b3b38a717d2e771c3f8c174f657c3","versionType":"git","status":"affected"},{"version":"19672ae68d52ff75347ebe2420dde1b07adca09f","lessThan":"f9204a2b78dd18374d3bcf9bf93d9021ce22de1b","versionType":"git","status":"affected"},{"version":"ab200d71553bdcf4de554a5985b05b2dd606bc57","lessThan":"c2a11441538bdbbc5aa003f190995eba93a89b88","versionType":"git","status":"affected"},{"version":"52a0a98549344ca20ad81a4176d68d28e3c05a5c","lessThan":"046fa5c72d15cd8e2d592e275697ea399d8f76b0","versionType":"git","status":"affected"},{"version":"52a0a98549344ca20ad81a4176d68d28e3c05a5c","lessThan":"ea8e356acb165cb1fd75537a52e1f66e5e76c538","versionType":"git","status":"affected"},{"version":"043b4307a99f902697349128fde93b2ddde4686c","versionType":"git","status":"affected"},{"version":"42afe8ed8ad2de9c19457156244ef3e1eca94b5d","versionType":"git","status":"affected"},{"version":"6.1.163","lessThan":"6.1.175","versionType":"semver","status":"affected"},{"version":"6.6.124","lessThan":"6.6.141","versionType":"semver","status":"affected"},{"version":"6.12.70","lessThan":"6.12.91","versionType":"semver","status":"affected"},{"version":"6.18.10","lessThan":"6.18.33","versionType":"semver","status":"affected"},{"version":"5.10.250","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.200","lessThan":"5.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/target/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.141","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.91","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.33","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.10","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]