CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: add bounds checks in nvmettcpbuildpduiovec
nvmettcpbuildpduiovec() could walk past cmd->req.sg when a PDU length or offset exceeds sgcnt and then use bogus sg->length/offset values, leading to copytoiter() GPF/KASAN. Guard sgidx, remaining entries, and sg->length/offset before building the bvec.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.257-1Fixed in 6.1.170-3Fixed in 6.1.174-1Fixed in 6.12.86-1Fixed in 6.12.90-2Fixed in 7.0.10-1Fixed in 7.0.12-2 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.174-1~deb11u1 - Remove
Remove
nvmet-tcp modulefrom your environment.If NVMe-oF TCP target functionality is not required, prevent the module from being loaded by creating `/etc/modprobe.d/blacklist-nvmet-tcp.conf` with `install nvmet-tcp /bin/false`, then unload the module with `rmmod nvmet-tcp`.
- Configuration
Disable anonymous host access by writing `0` to `/sys/kernel/config/nvmet/subsystems/<name>/attr_allow_any_host` for each configured NVMe target subsystem name.
Linux kernel NVMe target (nvmet) subsystem attr_allow_any_host ( /sys/kernel/config/nvmet/subsystems/<name>/attr_allow_any_host ) = 0 - Compensating control
On the firewall, allow ingress to NVMe-oF TCP listener port 4420 only from trusted initiator IPs (e.g., `ufw allow from <trusted_ip> to any port 4420 proto tcp`) and deny other ingress to 4420/tcp (e.g., `ufw deny in 4420/tcp`).
- Operational
For each configured NVMe target subsystem, list subsystem names and apply the anonymous-host access change: list with `ls /sys/kernel/config/nvmet/subsystems/`, then set `attr_allow_any_host` to `0` per `<name>`.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23112?
The severity of CVE-2026-23112 has been classified as moderate due to potential denial-of-service impacts.
How do I fix CVE-2026-23112?
To fix CVE-2026-23112, update your Linux kernel to the latest version that includes the bounds check patch.
Which versions of the Linux kernel are affected by CVE-2026-23112?
CVE-2026-23112 affects specific versions of the Linux kernel where the nvmet_tcp_build_pdu_iovec function is improperly handling input.
What components are impacted by CVE-2026-23112?
CVE-2026-23112 impacts the NVMe over TCP component of the Linux kernel, particularly during PDU processing.
Is there a workaround for CVE-2026-23112?
There is no official workaround for CVE-2026-23112; the recommended resolution is to apply the appropriate kernel update.