LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux NVMe-over-TCP target can make the kernel read invalid scatter-gather metadata while preparing network data. The documented outcome is a kernel fault detected as GPF/KASAN, potentially disrupting storage services or the host. The supplied CVSS score is 9.8, although the sources do not demonstrate confidentiality or integrity compromise.

Executive priority

Prioritize rapid assessment of network-reachable NVMe-over-TCP targets and patch confirmed affected systems through normal emergency-change controls. Immediate enterprise-wide kernel replacement is not justified solely by this bundle; first establish component use and vendor applicability. Escalate exposed production storage targets because a kernel crash could interrupt critical services.

Technical view

nvmet_tcp_build_pdu_iovec() insufficiently validated PDU length, offset, scatter-gather index, remaining entries, and segment boundaries. It could traverse beyond cmd->req.sg and pass bogus length or offset values into _copy_to_iter(), causing GPF/KASAN faults. Stable-kernel commits add bounds checks. The available description establishes unsafe memory access and crashes, but not reliable code execution.

Likely exposure

Exposure is limited to Linux systems using the NVMe target over TCP component on an affected kernel. Network reachability of that storage service materially increases concern. The supplied version data lists affected releases and stable commits but does not clearly express complete branch ranges, so distribution-specific package status must be confirmed.

Exploitation context

The CVSS vector describes network-accessible, low-complexity, unauthenticated exploitation without user interaction. However, CVE-2026-23112 is not identified as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. Treat the CVSS impact claims cautiously because the technical description specifically documents kernel faults rather than proven data theft, modification, or code execution.

Researcher notes

The central primitive is out-of-bounds traversal of scatter-gather entries during PDU iovec construction. New checks cover sg_idx, remaining entries, and segment length/offset validity. Sources establish a crash-class memory-safety condition but do not establish controlled corruption, information disclosure, or execution. Exact vulnerable ranges and branch-to-fix mappings should be taken from the relevant vendor advisory or stable commit history.

Mitigation direction

  • Update to a vendor-supported kernel release containing the applicable stable fix.
  • Consult the Linux distribution or appliance vendor for exact package and backport status.
  • Restrict NVMe-over-TCP target reachability to authorized storage networks while updates are pending.
  • Review the Siemens advisory when affected Siemens products may be present.

Validation and detection

  • Inventory hosts loading or configuring the Linux nvmet-tcp target component.
  • Record running kernel and vendor package versions on relevant storage hosts.
  • Confirm the installed kernel contains the applicable stable commit or vendor backport.
  • Check kernel logs for GPF, KASAN, nvmet_tcp_build_pdu_iovec, or _copy_to_iter events.
  • Verify NVMe-over-TCP listeners are reachable only from intended initiators.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23112 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-23112Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux872d26a391da92ed8f0c0f5cb5fef428067b7f30, 872d26a391da92ed8f0c0f5cb5fef428067b7f30, 872d26a391da92ed8f0c0f5cb5fef428067b7f30, 872d26a391da92ed8f0c0f5cb5fef428067b7f30, 872d26a391da92ed8f0c0f5cb5fef428067b7f30, 872d26a391da92ed8f0c0f5cb5fef428067b7f30, 872d26a391da92ed8f0c0f5cb5fef428067b7f30unaffected
LinuxLinux5.0, 0, 5.10.253, 5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.