LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23174: nvme-pci: handle changing device dma map requirements

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: handle changing device dma map requirements The initial state of dma_needs_unmap may be false, but change to true while mapping the data iterator. Enabling swiotlb is one such case that can change the result. The nvme driver needs to save the mapped dma vectors to be unmapped later, so allocate as needed during iteration rather than assume it was always allocated at the beginning. This fixes a NULL dereference from accessing an uninitialized dma_vecs when the device dma unmapping requirements change mid-iteration.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel storage-driver bug that can cause a kernel NULL pointer dereference when NVMe PCI DMA unmapping requirements change during I/O handling. The public record does not provide CVSS, attacker requirements, or impact beyond the crash condition, so urgency depends on affected kernel exposure and vendor guidance.

Executive priority

Track and patch through normal kernel maintenance unless the environment depends heavily on affected NVMe PCI systems or has crash symptoms. There is no public evidence in the supplied sources of active exploitation or remote compromise.

Technical view

The nvme-pci driver may assume DMA vector storage was allocated when dma_needs_unmap was initially false. If that requirement becomes true while mapping the data iterator, for example when SWIOTLB is enabled, later unmap handling can dereference uninitialized dma_vecs. Kernel stable commits allocate the DMA vector storage as needed during iteration.

Likely exposure

Likely exposure is Linux systems running affected kernel versions with NVMe PCI storage paths. The source lists Linux kernel version data including 6.17, 6.18.10, and 6.19, but distro backports and exact package status require vendor confirmation.

Exploitation context

No cited source states active exploitation, public exploit availability, or remote attackability. The CVE is not marked KEV. Available evidence supports a kernel crash or denial-of-service style impact, but not privilege escalation or data compromise.

Researcher notes

Key uncertainty is exploitability. The record describes a state-change bug in DMA unmap bookkeeping and a NULL dereference fix, but does not define triggering privileges, reachable workloads, CVSS, or security boundary impact. Validate against downstream kernel patches, not only upstream version labels.

Mitigation direction

  • Check Linux distribution advisories for CVE-2026-23174 coverage.
  • Update to a vendor kernel containing the referenced stable fixes.
  • Prioritize systems using NVMe PCI storage on affected kernel branches.
  • Avoid treating upstream version numbers as final distro package status.

Validation and detection

  • Inventory Linux kernel versions on NVMe PCI hosts.
  • Check kernel package changelogs for CVE-2026-23174 or referenced commits.
  • Review kernel logs for nvme-pci NULL dereference crashes.
  • Confirm vendor advisory status after patching or backporting.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23174 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb8b7570a7ec872f2a27b775c4f8710ca8a357adf, b8b7570a7ec872f2a27b775c4f8710ca8a357adfunaffected
LinuxLinux6.17, 0, 6.18.10, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.