CVE-2026-23112

EUVD-2026-6171
In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU
length or offset exceeds sg_cnt and then use bogus sg->length/offset
values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining
entries, and sg->length/offset before building the bvec.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
5.0 ≤
𝑥
< 5.10.250
linuxlinux_kernel
5.11 ≤
𝑥
< 5.15.200
linuxlinux_kernel
5.16 ≤
𝑥
< 6.1.163
linuxlinux_kernel
6.2 ≤
𝑥
< 6.6.124
linuxlinux_kernel
6.7 ≤
𝑥
< 6.12.70
linuxlinux_kernel
6.13 ≤
𝑥
< 6.18.10
linuxlinux_kernel
6.19:rc1
linuxlinux_kernel
6.19:rc2
linuxlinux_kernel
6.19:rc3
linuxlinux_kernel
6.19:rc4
linuxlinux_kernel
6.19:rc5
linuxlinux_kernel
6.19:rc6
linuxlinux_kernel
6.19:rc7
linuxlinux_kernel
6.19:rc8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bookworm
vulnerable
bookworm (security)
6.1.164-1
fixed
bullseye
vulnerable
bullseye (security)
5.10.251-1
fixed
forky
6.19.10-1
fixed
sid
6.19.11-1
fixed
trixie
6.12.73-1
fixed
trixie (security)
6.12.74-2
fixed
linux-6.1
bullseye (security)
6.1.164-1~deb11u1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://git.kernel.org/stable/c/043b4307a99f902697349128fde93b2ddde4686c
https://git.kernel.org/stable/c/1385be357e8acd09b36e026567f3a9d5c61139de
https://git.kernel.org/stable/c/19672ae68d52ff75347ebe2420dde1b07adca09f
https://git.kernel.org/stable/c/42afe8ed8ad2de9c19457156244ef3e1eca94b5d
https://git.kernel.org/stable/c/52a0a98549344ca20ad81a4176d68d28e3c05a5c
https://git.kernel.org/stable/c/ab200d71553bdcf4de554a5985b05b2dd606bc57
https://git.kernel.org/stable/c/dca1a6ba0da9f472ef040525fab10fd9956db59f