Answer in brief
CVE-2026-23112 records a Critical severity (CVSS 9.8) vulnerability in nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=872d26a391da92ed8f0c0f5cb5fef428067b7f30 <0b9981751be14b59b4473383c731c833738aebdb || >=872d26a391da92ed8f0c0f5cb5fef428067b7f30 <42afe8ed8ad2de9c19457156244ef3e1eca94b5d || >=872d26a391da92ed8f0c0f5cb5fef428067b7f30 <1385be357e8acd09b36e026567f3a9d5c61139de || >=872d26a391da92ed8f0c0f5cb5fef428067b7f30 <dca1a6ba0da9f472ef040525fab10fd9956db59f || >=872d26a391da92ed8f0c0f5cb5fef428067b7f30 <19672ae68d52ff75347ebe2420dde1b07adca09f || >=872d26a391da92ed8f0c0f5cb5fef428067b7f30 <ab200d71553bdcf4de554a5985b05b2dd606bc57 || >=872d26a391da92ed8f0c0f5cb5fef428067b7f30 <52a0a98549344ca20ad81a4176d68d28e3c05a5c | 0b9981751be14b59b4473383c731c833738aebdb, 42afe8ed8ad2de9c19457156244ef3e1eca94b5d, 1385be357e8acd09b36e026567f3a9d5c61139de, dca1a6ba0da9f472ef040525fab10fd9956db59f, 19672ae68d52ff75347ebe2420dde1b07adca09f, ab200d71553bdcf4de554a5985b05b2dd606bc57, 52a0a98549344ca20ad81a4176d68d28e3c05a5c |
| Linux/Linuxgeneric | 5.0 | Not reported |
| Siemens/RUGGEDCOM RST2428Pgeneric | >=0 <V4.0 | V4.0 |
Published upstream
Feb 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec.
Quoted source text, attributed separately from HOL analysis.