CVE-2026-23112
Out-of-Bounds Read in Linux nvmet-tcp Causes Kernel Crash
Publication date: 2026-02-13
Last updated on: 2026-05-04
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 5.16 (inc) to 6.1.163 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.70 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.124 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.10 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 5.0 (inc) to 5.10.250 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.200 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's nvmet-tcp component, specifically in the function nvmet_tcp_build_pdu_iovec(). The function could read beyond the bounds of the cmd->req.sg array when a Protocol Data Unit (PDU) length or offset exceeds the number of scatter-gather entries (sg_cnt). This out-of-bounds access could cause the function to use invalid scatter-gather length or offset values, potentially leading to a general protection fault (GPF) or Kernel Address Sanitizer (KASAN) error during a memory copy operation (_copy_to_iter()).
How can this vulnerability impact me? :
The impact of this vulnerability could include system crashes or kernel faults due to invalid memory access. This could lead to denial of service conditions where the affected Linux system becomes unstable or unresponsive. Additionally, such faults might be exploitable to cause further security issues, although specific exploitability details are not provided.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know