Severity: Critical
A critical vulnerability has been disclosed in the Linux kernel NVMe target over TCP (nvmet-tcp) code path, affecting multiple enterprise Linux distributions commonly used in infrastructure and data environments.
The vulnerability, tracked as CVE-2026-23112, is caused by a bug that misses a bounds check, this means that a crafted PDU length or offset can make the code walk past the scatter-gather list and use an invalid value, which can trigger kernel faults such as GPF/KASAN crashes. This can potentially result in the bug being used as a remote DoS (Denial of Service) against hosts exposing the nvmet-tcp service.
Systems exposing the nvmet-tcp service may be particularly vulnerable to remote exploitation. As part of Beeks’ commitment to supporting operational resilience and cyber risk management, this advisory is intended to help organisations assess exposure and implement appropriate mitigations.
Affected Software:
- Ubuntu 18.04 – 25.10
- SUSE Linux Enterprise Micro 5.2 – 5.5
- SUSE Linux Enterprise Server 15 SP7 – 16.1
- Debian bookworm (6.1.159-1)
- Debian bullseye (5.10.223-1)
Immediate Recommended Actions:
- Update the host OS to the lastest version, ensuring that security updates are installed.
- Disable the nvmet-tcp service.
- Find more mitigation steps here: https://ubuntu.com/security/CVE-2026-23112#mitigation
Further Information:
For detailed information on the vulnerability, please refer to the following sources:
https://ubuntu.com/security/CVE-2026-23112
https://nvd.nist.gov/vuln/detail/CVE-2026-23112
https://www.suse.com/security/cve/CVE-2026-23112.html
https://security-tracker.debian.org/tracker/CVE-2026-23112
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-23112
We understand the seriousness of this issue and the potential impact on your operations. Please take immediate action to secure your systems and mitigate any potential risks.
If you have any questions or require further assistance, please contact [email protected] or reach out to your Beeks account representative.
Note: This advisory is issued to help ensure the security of your systems and prevent disruption to critical services. Beeks remains committed to providing timely security information and support to safeguard your infrastructure.
Beeks will continue to monitor this and related vulnerabilities and provide updates through our Security Advisory.
