CVE-2026-23112 nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
A missing bounds check in the Linux kernel's NVMe over TCP driver allows out-of-bounds memory access, potentially causing crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23112?
CVE-2026-23112 is a critical memory corruption vulnerability in Linux kernel, published on 13 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec.
Which versions are affected by CVE-2026-23112?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23112?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-23112 being exploited?
There is no known exploitation of CVE-2026-23112 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-77487, BELL-CVE-2026-23112, DEBIAN-CVE-2026-23112, GHSA-jjrf-jfrm-p64x, ROOT-OS-DEBIAN-11-CVE-2026-23112, ROOT-OS-DEBIAN-12-CVE-2026-23112 and 3 more.