CVE-2026-23112: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23112 Overview

CVE-2026-23112 is an out-of-bounds memory access vulnerability in the Linux kernel's NVMe-oF (NVMe over Fabrics) TCP target subsystem. The vulnerability exists in the nvmet_tcp_build_pdu_iovec() function, which fails to properly validate boundaries when building Protocol Data Unit (PDU) I/O vectors. When a PDU length or offset exceeds the scatter-gather count (sg_cnt), the function can walk past the cmd->req.sg array boundaries, leading to the use of invalid sg->length and sg->offset values. This results in General Protection Fault (GPF) crashes and KASAN (Kernel Address Sanitizer) memory access violations during _copy_to_iter() operations.

Critical Impact

This vulnerability can cause kernel crashes and system instability on Linux systems running NVMe-oF TCP targets, potentially leading to denial of service conditions in storage infrastructure environments.

Affected Products

• Linux Kernel (NVMe-oF TCP target subsystem)
• Systems running nvmet-tcp kernel module
• NVMe over Fabrics storage targets using TCP transport

Discovery Timeline

• 2026-02-13 - CVE CVE-2026-23112 published to NVD
• 2026-02-13 - Last updated in NVD database

Technical Details for CVE-2026-23112

Vulnerability Analysis

The vulnerability resides in the nvmet_tcp_build_pdu_iovec() function within the NVMe-oF TCP target implementation. This function is responsible for constructing I/O vectors (iovec) from scatter-gather lists for PDU data transfer operations. The core issue is the absence of proper bounds checking when iterating through the scatter-gather entries.

During normal operation, the function traverses the scatter-gather list associated with a command request (cmd->req.sg) to build a bio_vec structure for data transfer. However, when crafted or malformed PDU parameters specify lengths or offsets that exceed the actual number of scatter-gather entries (sg_cnt), the function continues to iterate beyond the valid array boundaries. This leads to reading uninitialized or invalid memory for sg->length and sg->offset values.

When these bogus values are subsequently used in the _copy_to_iter() function, the kernel attempts to access memory at invalid addresses, triggering either a General Protection Fault (GPF) in production systems or a KASAN violation in debug-enabled kernels.

Root Cause

The root cause is missing input validation and boundary checking in nvmet_tcp_build_pdu_iovec(). The function does not verify that:

1. The sg_idx (scatter-gather index) remains within valid bounds of the scatter-gather array
2. The remaining entries count is properly validated before array access
3. The sg->length and sg->offset values are sanity-checked before use in memory operations

The fix introduces guards for sg_idx, remaining entries, and sg->length/sg->offset validation before constructing the bvec structure.

Attack Vector

The attack vector for this vulnerability involves sending specially crafted NVMe-oF TCP PDUs to vulnerable NVMe targets. An attacker with network access to an NVMe-oF TCP target can manipulate PDU parameters to trigger the out-of-bounds memory access condition:

1. The attacker establishes a connection to the NVMe-oF TCP target
2. A malicious PDU is constructed with length or offset values designed to exceed the scatter-gather count
3. When the target processes this PDU, nvmet_tcp_build_pdu_iovec() iterates past array boundaries
4. The resulting invalid memory access causes a kernel panic or system crash

The vulnerability primarily enables denial of service attacks. While the out-of-bounds read could theoretically leak kernel memory contents, the primary observed behavior is system instability and crashes.

Detection Methods for CVE-2026-23112

Indicators of Compromise

• Kernel panic messages containing references to nvmet_tcp_build_pdu_iovec or _copy_to_iter in the call stack
• KASAN reports indicating out-of-bounds access in NVMe-oF TCP target code paths
• Unexpected crashes or reboots on systems running NVMe-oF TCP target services
• GPF (General Protection Fault) errors logged in kernel messages related to nvmet-tcp module

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for GPF or KASAN violations referencing nvmet-tcp functions
• Deploy KASAN-enabled kernels in staging environments to detect memory access violations
• Implement network monitoring for anomalous NVMe-oF TCP traffic patterns targeting storage infrastructure
• Use kernel crash dump analysis tools to identify nvmet-tcp related crashes

Monitoring Recommendations

• Enable kernel crash dumps (kdump) to capture diagnostic information when crashes occur
• Configure alerting for unexpected NVMe-oF target service restarts or kernel panics
• Monitor system stability metrics for servers running nvmet-tcp workloads
• Review NVMe-oF connection logs for unusual client behavior or malformed requests

How to Mitigate CVE-2026-23112

Immediate Actions Required

• Apply the available kernel patches from the Linux kernel stable tree
• Restrict network access to NVMe-oF TCP target ports (typically port 4420) to trusted clients only
• Consider temporarily disabling nvmet-tcp module on non-critical systems until patching is complete
• Implement network segmentation to isolate NVMe-oF storage traffic from untrusted networks

Patch Information

Multiple patch commits are available in the Linux kernel stable tree to address this vulnerability. The fixes add proper bounds checking in nvmet_tcp_build_pdu_iovec() to guard sg_idx, remaining entries, and sg->length/sg->offset values before building the bvec structure.

Available Patch Commits:

• Commit 043b4307a99f
• Commit 1385be357e8a
• Commit 19672ae68d52
• Commit 42afe8ed8ad2
• Commit 52a0a9854934
• Commit ab200d71553b
• Commit dca1a6ba0da9

Workarounds

• Implement firewall rules to restrict access to NVMe-oF TCP target ports from untrusted networks
• Use network-level authentication and encryption (IPsec) for NVMe-oF TCP connections
• Disable the nvmet-tcp kernel module if NVMe-oF TCP functionality is not required
• Deploy intrusion detection systems to monitor for exploit attempts targeting NVMe-oF services

# Restrict NVMe-oF TCP access using iptables
iptables -A INPUT -p tcp --dport 4420 -s <trusted_network>/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4420 -j DROP

# Unload nvmet-tcp module if not in use
modprobe -r nvmet-tcp
echo "blacklist nvmet-tcp" >> /etc/modprobe.d/blacklist-nvmet.conf