CVE-2026-23112

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec.

An out of bounds access in the NVMe TCP target can occur in nvmet_tcp_build_pdu_iovec when a crafted PDU length or data offset causes sg_idx to exceed cmd req sg_cnt or causes iteration past the remaining scatterlist entries. This can make the code use bogus sg length and offset values and then crash in _copy_to_iter with a general protection fault or a KASAN report. The issue is network reachable in environments that expose NVMe over TCP to initiators (usually in local networks or by VPN, so for the CVSS keeping AV:A). Impact is a reliable denial of service via kernel crash. In a conservative assessment memory corruption patterns may also be considered for potential confidentiality or integrity impact. The NVME over TCP for the case of being target like this one is (means RHEL system being used by other systems as a storage device) not supported for the Red Hat Enterprise Linux, but could be enabled by administrator anyway.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module nvmet-tcp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.