𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟮𝟯𝟭𝟭𝟮: 𝗡𝗩𝗠𝗲/𝗧𝗖𝗣 𝗞𝗲𝗿𝗻𝗲𝗹 𝗗𝗼𝗦 𝗩𝗲𝗰𝘁𝗼𝗿 – 𝗤𝘂𝗶𝗰𝗸 𝗜𝗻𝘀𝗶𝗴𝗵𝘁

🔐 𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟮𝟯𝟭𝟭𝟮: 𝗡𝗩𝗠𝗲/𝗧𝗖𝗣 𝗞𝗲𝗿𝗻𝗲𝗹 𝗗𝗼𝗦 𝗩𝗲𝗰𝘁𝗼𝗿 – 𝗤𝘂𝗶𝗰𝗸 𝗜𝗻𝘀𝗶𝗴𝗵𝘁

A new Linux kernel vulnerability (CVE-2026-23112) affects the NVMe/TCP target (nvmet-tcp), exposing systems to potential kernel crashes and Denial of Service (DoS) conditions.

⚙️ 𝗪𝗵𝗮𝘁’𝘀 𝗵𝗮𝗽𝗽𝗲𝗻𝗶𝗻𝗴?

Improper validation in nvmet_tcp_build_pdu_iovec()

Out-of-bounds access in scatter-gather (SG) lists

Triggered via crafted NVMe/TCP traffic

➡️ Result: NULL pointer dereference → kernel panic

🚨 𝗪𝗵𝘆 𝗶𝘁 𝗺𝗮𝘁𝘁𝗲𝗿𝘀

Impacts availability, not privilege escalation

Relevant in NVMe/TCP storage environments

Higher risk if exposed beyond trusted networks

🛡️ 𝗥𝗘𝗟𝗜𝗔𝗡𝗢𝗜𝗗 𝗦𝘁𝗮𝘁𝘂𝘀: 𝗡𝗼𝘁 𝗮𝗳𝗳𝗲𝗰𝘁𝗲𝗱

NVMe/TCP target is 𝗻𝗼𝘁 𝘂𝘀𝗲𝗱 𝗻𝗼𝗿 𝗹𝗼𝗮𝗱𝗲𝗱

Not part of the RELIANOID architecture

➡️ No exploit path in real deployments

✅ 𝗥𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗮𝘁𝗶𝗼𝗻

No immediate action required for RELIANOID users

Upgrade to:

EE > 8.5

CE > 7.9

Review NVMe/TCP exposure in your infrastructure

👉 Full technical breakdown in the article below.

https://www.relianoid.com/resources/knowledge-base/troubleshooting/cve-2026-23112-null-pointer-dereference-in-nvme-tcp-nvmet_tcp_build_pdu_iovec/

#CyberSecurity #LinuxKernel #NVMe #CIO #ITSecurity #Networking #RELIANOID