CVE-2026-23112

nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

State: Published
Severity: 9.8 Critical
Published: Feb 13, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 0b9981751be14b59b4473383c731c833738aebdbAffected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 42afe8ed8ad2de9c19457156244ef3e1eca94b5dAffected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 1385be357e8acd09b36e026567f3a9d5c61139deAffected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before dca1a6ba0da9f472ef040525fab10fd9956db59fAffected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 19672ae68d52ff75347ebe2420dde1b07adca09fAffected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before ab200d71553bdcf4de554a5985b05b2dd606bc57Affected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 52a0a98549344ca20ad81a4176d68d28e3c05a5cAffected
LinuxLinux	5.0Affected before 5.0Not affected 5.10.253 through 5.10.Not affected 5.15.200 through 5.15.Not affected 6.1.163 through 6.1.Not affected 6.6.124 through 6.6.Not affected 6.12.70 through 6.12.Not affected 6.18.10 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 0b9981751be14b59b4473383c731c833738aebdbAffected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 42afe8ed8ad2de9c19457156244ef3e1eca94b5dAffected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 1385be357e8acd09b36e026567f3a9d5c61139deAffected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before dca1a6ba0da9f472ef040525fab10fd9956db59fAffected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 19672ae68d52ff75347ebe2420dde1b07adca09fAffected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before ab200d71553bdcf4de554a5985b05b2dd606bc57Affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 52a0a98549344ca20ad81a4176d68d28e3c05a5cAffected

LinuxLinux

5.0Affected
before 5.0Not affected
5.10.253 through 5.10.*Not affected
5.15.200 through 5.15.*Not affected
6.1.163 through 6.1.*Not affected
6.6.124 through 6.6.*Not affected
6.12.70 through 6.12.*Not affected
6.18.10 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.