CVE-2026-23112: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23112 is an out-of-bounds write vulnerability in the Linux kernel's nvmet-tcp module, specifically in the nvmet_tcp_build_pdu_iovec() function. The flaw allows the function to walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt, resulting in use of bogus sg->length/offset values and triggering GPF/KASAN errors via _copy_to_iter(). Affected kernel versions include 5.0–5.10.249, 5.11–5.15.199, 5.16–6.1.162, 6.2–6.6.123, 6.7–6.12.69, and 6.13–6.18.9, as well as 6.19-rc1 through rc8. The vulnerability was published on February 13, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (Feedly, Kernel Patches).

The root cause is a missing bounds check (CWE-787: Out-of-bounds Write) in nvmet_tcp_build_pdu_iovec() within the Linux kernel's NVMe-over-TCP target (nvmet-tcp) subsystem. When processing incoming NVMe/TCP PDUs, the function iterates over scatter-gather (SG) list entries to build a bio vector (bvec); if a PDU's length or offset field exceeds the actual sg_cnt, the loop index sg_idx advances past the end of cmd->req.sg, causing reads of stale or attacker-influenced sg->length and sg->offset values. These bogus values are then passed to _copy_to_iter(), triggering a kernel General Protection Fault (GPF) or KASAN out-of-bounds write report. The fix adds explicit guards on sg_idx, remaining entry count, and individual sg->length/offset values before constructing the bvec (Feedly).

Successful exploitation can cause kernel crashes (denial of service) by triggering a GPF or KASAN fault, rendering affected NVMe/TCP target systems unavailable. Because the out-of-bounds write corrupts kernel memory, there is also a theoretical risk of privilege escalation or arbitrary code execution in the kernel context, which would result in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability is exploitable remotely over the network without authentication or user interaction, making any Linux system exposing NVMe/TCP target services to untrusted networks a high-risk asset (Feedly).

1. Reconnaissance: Identify Linux systems exposing NVMe/TCP target services (default TCP port 4420) using network scanning tools such as Nmap (nmap -p 4420 <target>) or Shodan, targeting kernel versions in the affected ranges.
2. Establish NVMe/TCP connection: Use an NVMe initiator (e.g., nvme-cli with nvme connect) to establish a TCP connection to the target's NVMe subsystem.
3. Craft malicious PDU: Construct a malformed NVMe/TCP PDU (e.g., a Data PDU or Capsule PDU) with a data_length or data_offset field set to a value exceeding the actual scatter-gather list count (sg_cnt) of the target command.
4. Trigger out-of-bounds write: Send the crafted PDU to the target. The nvmet_tcp_build_pdu_iovec() function will walk past the end of cmd->req.sg, reading bogus length/offset values and passing them to _copy_to_iter(), causing a kernel GPF or KASAN out-of-bounds write.
5. Achieve denial of service or further exploitation: The immediate result is a kernel panic/crash (DoS). With further research, the memory corruption may be leveraged for kernel code execution, depending on kernel hardening mitigations in place (Feedly).

• Network: Unexpected or malformed NVMe/TCP connections on TCP port 4420 from untrusted or external IP addresses; high-volume or repeated connection attempts to the NVMe/TCP target port.
• Logs: Kernel logs (dmesg, /var/log/kern.log) showing GPF (General Protection Fault) messages, KASAN out-of-bounds write reports, or kernel oops/panic traces referencing nvmet_tcp_build_pdu_iovec or _copy_to_iter.
• System Behavior: Unexpected system reboots or kernel panics on hosts running NVMe/TCP target services; NVMe target daemon crashes or restarts without administrative action.
• Process: Kernel crash dumps (vmcore) generated on NVMe/TCP target hosts, particularly those referencing the nvmet-tcp module in the stack trace (Feedly).

Patches are available in the following fixed kernel versions: 5.10.250, 5.15.200, 6.1.163, 6.6.124, 6.12.70, and 6.18.10 or later. Multiple patch commits have been merged into the Linux kernel stable tree (Kernel Patches). Downstream distributions including Debian (DSA-6141-1, DSA-6163-1, DLA-4498-1), Ubuntu (USN-8244-1, USN-8254-1, USN-8255-1, USN-8273-1, USN-8275-1, USN-8297-1), and Oracle Linux have released updated kernel packages. As an interim workaround, restrict NVMe/TCP traffic (TCP port 4420) to trusted hosts using firewall rules, or disable the nvmet-tcp kernel module (modprobe -r nvmet-tcp) if NVMe/TCP target functionality is not required (Feedly).

The vulnerability has been picked up by standard Linux security advisory channels including Debian, Ubuntu, and Oracle Linux, with multiple distribution-level security advisories issued. Security scanning vendors Tenable (Nessus) and Qualys have added detection plugins for this CVE. No notable independent researcher commentary or significant social media discussion has been identified beyond routine vulnerability tracking (Feedly).