{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23112","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-01-13T15:37:45.968Z","datePublished":"2026-02-13T13:29:56.724Z","dateUpdated":"2026-05-11T22:00:21.299Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T22:00:21.299Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec\n\nnvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU\nlength or offset exceeds sg_cnt and then use bogus sg->length/offset\nvalues, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining\nentries, and sg->length/offset before building the bvec."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"}}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/tcp.c"],"versions":[{"version":"872d26a391da92ed8f0c0f5cb5fef428067b7f30","lessThan":"0b9981751be14b59b4473383c731c833738aebdb","status":"affected","versionType":"git"},{"version":"872d26a391da92ed8f0c0f5cb5fef428067b7f30","lessThan":"42afe8ed8ad2de9c19457156244ef3e1eca94b5d","status":"affected","versionType":"git"},{"version":"872d26a391da92ed8f0c0f5cb5fef428067b7f30","lessThan":"1385be357e8acd09b36e026567f3a9d5c61139de","status":"affected","versionType":"git"},{"version":"872d26a391da92ed8f0c0f5cb5fef428067b7f30","lessThan":"dca1a6ba0da9f472ef040525fab10fd9956db59f","status":"affected","versionType":"git"},{"version":"872d26a391da92ed8f0c0f5cb5fef428067b7f30","lessThan":"19672ae68d52ff75347ebe2420dde1b07adca09f","status":"affected","versionType":"git"},{"version":"872d26a391da92ed8f0c0f5cb5fef428067b7f30","lessThan":"ab200d71553bdcf4de554a5985b05b2dd606bc57","status":"affected","versionType":"git"},{"version":"872d26a391da92ed8f0c0f5cb5fef428067b7f30","lessThan":"52a0a98549344ca20ad81a4176d68d28e3c05a5c","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/tcp.c"],"versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","status":"unaffected","versionType":"semver"},{"version":"5.10.253","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.200","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.163","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.124","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.70","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.10","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"5.10.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"5.15.200"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.1.163"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.6.124"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.12.70"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.18.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.19"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0b9981751be14b59b4473383c731c833738aebdb"},{"url":"https://git.kernel.org/stable/c/42afe8ed8ad2de9c19457156244ef3e1eca94b5d"},{"url":"https://git.kernel.org/stable/c/1385be357e8acd09b36e026567f3a9d5c61139de"},{"url":"https://git.kernel.org/stable/c/dca1a6ba0da9f472ef040525fab10fd9956db59f"},{"url":"https://git.kernel.org/stable/c/19672ae68d52ff75347ebe2420dde1b07adca09f"},{"url":"https://git.kernel.org/stable/c/ab200d71553bdcf4de554a5985b05b2dd606bc57"},{"url":"https://git.kernel.org/stable/c/52a0a98549344ca20ad81a4176d68d28e3c05a5c"}],"title":"nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec","x_generator":{"engine":"bippy-1.2.0"}}}}