Critical 9.8Published Feb 13, 2026

CVE-2026-23112nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

Updated under an hour ago (Oct 27, 2026, 5:23 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 0b9981751be14b59b4473383c731c833738aebdb; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 42afe8ed8ad2de9c19457156244ef3e1eca94b5d; from 872d26a391da92ed8f0c0f5cb5fef428067b7f30 before 1385be357e8acd09b36e026567f3a9d5c61139de; from 872d26a391da92ed8f0c0f5cb5fef428067b7f30 before dca1a6ba0da9f472ef040525fab10fd9956db59f; from 872d26a391da92ed8f0c0f5cb5fef428067b7f30 before 19672ae68d52ff75347ebe2420dde1b07adca09f; from 872d26a391da92ed8f0c0f5cb5fef428067b7f30 before ab200d71553bdcf4de554a5985b05b2dd606bc57; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 52a0a98549344ca20ad81a4176d68d28e3c05a5c	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V4.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.0 before 5.10.250; from 5.11 before 5.15.200; from 5.16 before 6.1.163; from 6.2 before 6.6.124; from 6.7 before 6.12.70; from 6.13 before 6.18.10; 6.19; 6.19; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/0b9981751be14b59b4473383c731c833738aebdb
https://git.kernel.org/stable/c/42afe8ed8ad2de9c19457156244ef3e1eca94b5d	patch
https://git.kernel.org/stable/c/1385be357e8acd09b36e026567f3a9d5c61139de	patch
https://git.kernel.org/stable/c/dca1a6ba0da9f472ef040525fab10fd9956db59f	patch
https://git.kernel.org/stable/c/19672ae68d52ff75347ebe2420dde1b07adca09f	patch
https://git.kernel.org/stable/c/ab200d71553bdcf4de554a5985b05b2dd606bc57	patch
https://git.kernel.org/stable/c/52a0a98549344ca20ad81a4176d68d28e3c05a5c	patch
https://cert-portal.siemens.com/productcert/html/ssa-253495.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.