[{"id":3673719,"web_url":"http://patchwork.ozlabs.org/comment/3673719/","msgid":"<20260406122701.zjg4ehpzqy5kj4m2@wintermute.fritz.box>","list_archive_url":null,"date":"2026-04-06T12:27:01","subject":"ACK: [SRU][Q/N/J][PATCH 0/3] CVE-2026-23112","submitter":{"id":86131,"url":"http://patchwork.ozlabs.org/api/people/86131/","name":"Manuel Diewald","email":"manuel.diewald@canonical.com"},"content":"On Mon, Apr 06, 2026 at 01:51:15PM +0300, Cengiz Can wrote:\n> https://ubuntu.com/security/CVE-2026-23112\n> \n> [ Impact ]\n> \n> nvmet_tcp_build_pdu_iovec() can walk past cmd->req.sg when a PDU length\n> or offset exceeds sg_cnt, then use bogus sg->length/offset values leading\n> to _copy_to_iter() GPF/KASAN. An attacker with access to the NVMe-TCP\n> target interface could trigger a kernel crash.\n> \n> \n> [ Fix ]\n> \n> Cherry-picked from mainline for questing and noble. Adjusted for jammy\n> due to older iovec style.\n> \n> \n> [ Test Plan ]\n> \n> All three kernels were compile-tested and boot-tested. PoC verification\n> confirmed the vulnerability is no longer triggerable after the fix.\n> \n> \n> [ Where Problems Could Occur ]\n> \n> If the bounds checks are incorrect, NVMe-TCP connections could be\n> prematurely terminated or the target could become unresponsive. In the\n> worst case, a malformed check could still allow out-of-bounds access.\n> \n> \n> \n> -- \n> kernel-team mailing list\n> kernel-team@lists.ubuntu.com\n> https://lists.ubuntu.com/mailman/listinfo/kernel-team\n\nAcked-by: Manuel Diewald <manuel.diewald@canonical.com>","headers":{"Return-Path":"<kernel-team-bounces@lists.ubuntu.com>","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=ZGCezOV4;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fq7rB5c7sz1yFt\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 06 Apr 2026 22:27:22 +1000 (AEST)","from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1w9j2o-00078t-0s; Mon, 06 Apr 2026 12:27:06 +0000","from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <manuel.diewald@canonical.com>)\n id 1w9j2m-00078k-DC\n for kernel-team@lists.ubuntu.com; Mon, 06 Apr 2026 12:27:04 +0000","from mail-wr1-f70.google.com (mail-wr1-f70.google.com\n [209.85.221.70])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 372A73F1CC\n for <kernel-team@lists.ubuntu.com>; Mon,  6 Apr 2026 12:27:04 +0000 (UTC)","by mail-wr1-f70.google.com with SMTP id\n ffacd0b85a97d-43d022974acso4403345f8f.2\n for <kernel-team@lists.ubuntu.com>; Mon, 06 Apr 2026 05:27:04 -0700 (PDT)","from localhost ([2001:16b8:a7c8:2e00:9466:c9ff:fefc:5627])\n by smtp.gmail.com with ESMTPSA id\n ffacd0b85a97d-43d214f2b63sm36083531f8f.28.2026.04.06.05.27.02\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Mon, 06 Apr 2026 05:27:02 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1775478424;\n bh=Ij4VhZi6vEpbS7smymSPRjj5uOBIWRDhLtDRfp/VVuM=;\n h=Date:From:To:Subject:Message-ID:References:MIME-Version:\n Content-Type:In-Reply-To;\n b=ZGCezOV4afAv2NoMO7d2t6upwhnwMSFrvV4hkAQBxgoZ9gCeEUZan6o9Z5vIf+aBR\n Fa9VTqyutNLULce61P3gAs/CYRLufUS1S0s0xDT7Z7aky8mDYlbq3OnRZyDGphMYrw\n lTnRQMBHTaRT1pOARILEaq/XgPSFQJoqdoTE6seiRDu5rPTnq14EE2rlFRD46JXVV0\n MaMYf91vUfBCss8gFuS3Z31B+C+RrMCSzMN5VPfyOGwK34vwH7TnHAMPBrFVT8jXvl\n dxJdgBX75m9P9J0i8cAg2cvzBhaQNltU9rrm/2/9Nu8LZgCtffWRb8p6maQGXTr98j\n 771iWw8qT9EhzZ5uMVVDmKqtRHt0+kIxxtCzE4TaGSVXn5vYjSbTvXoclKoe5E2hpt\n DQ2O1y4X5kpaZpx2fTQslDSQdNPXZmpFpWfZcZ7bBMraDuZekqcPVWIxzf668L92ec\n VH1joZvTVs8OQmcEecNR37dw1ZG8KFc8Ud4r1RBi0tpoLyV3c9xlmstul6/axq2+VF\n 3XpdkkPa6/+MLA42FKtG5MJ4p4J23w7Djsm1HYlCvfzd/8l4pc3DbYQnKWH+Ulhg2Y\n aLU1oWFYZh/t9d2E3rf++JVHcxAcxIHXP2GqXXvqP6l765Iut5BtiAJMkePBUiE6NF\n dxLQm9p0cCfuRavlH+IuxoDc=","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775478424; x=1776083224;\n h=in-reply-to:content-disposition:mime-version:references\n :mail-followup-to:message-id:subject:to:from:date:x-gm-gg\n :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;\n bh=Ij4VhZi6vEpbS7smymSPRjj5uOBIWRDhLtDRfp/VVuM=;\n b=N4FoF2iGiWygsLyy6/Br6fM7vz+5rR9dSo9O2R1/vornbAsZwXtuj95mFF2Q8KIeap\n N0e7h/mSkLa7CG+y0KMEUGxMEQId8BK4vuTq+ZzHcotgBSlHSG0GwgDLTHbt7T+bv2aW\n xt2WIGdt/6LPqdOaWbg+gk7M2DpMgFLWLUk6ShQBtSJcT0fVAQB64WO8tAiBV6/ILMSh\n hyk1h2TFKSALQNhgij0QWJ6blPo8qIBLHa6Wa74352zzNjTY39IzGxmrL6j4lwVCI0ot\n 4cP7BQf8SkXmwoF/3ypdE5xMwcIV10cpYKCthGN5FOQdrCEx+fhD/5pb/JxS34pxnB5c\n TPHg==","X-Forwarded-Encrypted":"i=1;\n AJvYcCW7bSTxJnWzUfadOlm4kOXmZfpKU1FqzXSl8KjAh8qeOybihAm97UEA7+xmgnCEz5kHL121XNjiIDCjLA==@lists.ubuntu.com","X-Gm-Message-State":"AOJu0YxtzUR10+TaFKEr8jATUKdjmLguPGpTu+EH934om4d1zUvG1aWO\n fmCEcCTcBxj7Q3XT9uCc/UPbwEQHO51F0bvO9EZvRMOZwcskWBSGeg7Gmx9603ZjPVZxNk+z95h\n dqXZyp4Axu35bW4H7bSLhOpyJBiPOH/zIPsoz8IFtJZLvukv00aEm84V2uPut+nJkkoapU5sgWl\n rJ6H70aI6GRM7zfA==","X-Gm-Gg":"AeBDietoep5cJaUU6cNqcdPxG9lvox+69f1S9Tp+O712dnZIUFpxcDtP64SsMeEHP8h\n mgsHEPRhTNm18gElavSEV80T2UbfuPZA39FcSbQJytQKBtvsOf7Zqx2qTGqu5b/OlVOzzoq5G7L\n eGgSnY0atJEYShqEA8lu4aXV0Z3+5gDdTedUCQDbOR+0OKfP1G6nUujOcMiIqE31caC0SZrC1SR\n OIib+4e9CX2fEjlhEndlS6sgzajRfCvxgPD+MnQePTmwhb7E8zFuvOaiKFE1PFDjnY8TmbLm5qx\n 0N0ajMhbvvpCVEqrKqGc/dmSPTSK6cmUTAtaXRG6zJAmXE9K4COW881w2CNJPiHfgeKAVpkHCUg\n 5rIO6TMqqzA4TAcTy4lSFOsL8IBvUQoBe","X-Received":["by 2002:a05:6000:230a:b0:43d:1c59:2dc with SMTP id\n ffacd0b85a97d-43d292c76eemr18813160f8f.28.1775478423686;\n Mon, 06 Apr 2026 05:27:03 -0700 (PDT)","by 2002:a05:6000:230a:b0:43d:1c59:2dc with SMTP id\n ffacd0b85a97d-43d292c76eemr18813118f8f.28.1775478423218;\n Mon, 06 Apr 2026 05:27:03 -0700 (PDT)"],"Date":"Mon, 6 Apr 2026 14:27:01 +0200","From":"Manuel Diewald <manuel.diewald@canonical.com>","To":"Cengiz Can <cengiz.can@canonical.com>, kernel-team@lists.ubuntu.com","Subject":"ACK: [SRU][Q/N/J][PATCH 0/3] CVE-2026-23112","Message-ID":"<20260406122701.zjg4ehpzqy5kj4m2@wintermute.fritz.box>","Mail-Followup-To":"Cengiz Can <cengiz.can@canonical.com>,\n kernel-team@lists.ubuntu.com","References":"<177546945105.885203.15305511673780617858@nexus9.public>","MIME-Version":"1.0","In-Reply-To":"<177546945105.885203.15305511673780617858@nexus9.public>","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions <kernel-team.lists.ubuntu.com>","List-Unsubscribe":"<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>","List-Archive":"<https://lists.ubuntu.com/archives/kernel-team>","List-Post":"<mailto:kernel-team@lists.ubuntu.com>","List-Help":"<mailto:kernel-team-request@lists.ubuntu.com?subject=help>","List-Subscribe":"<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>","Content-Type":"multipart/mixed; boundary=\"===============1970045780550770939==\"","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>"}},{"id":3675073,"web_url":"http://patchwork.ozlabs.org/comment/3675073/","msgid":"<cf5e46f5-87f5-48e3-a9ea-2d6d5a9b19a2@canonical.com>","list_archive_url":null,"date":"2026-04-09T04:52:20","subject":"ACK: [SRU][Q/N/J][PATCH 0/3] CVE-2026-23112","submitter":{"id":85372,"url":"http://patchwork.ozlabs.org/api/people/85372/","name":"Masahiro Yamada","email":"masahiro.yamada@canonical.com"},"content":"On 4/6/26 19:51, Cengiz Can wrote:\n> https://ubuntu.com/security/CVE-2026-23112\n>\n> [ Impact ]\n>\n> nvmet_tcp_build_pdu_iovec() can walk past cmd->req.sg when a PDU length\n> or offset exceeds sg_cnt, then use bogus sg->length/offset values leading\n> to _copy_to_iter() GPF/KASAN. An attacker with access to the NVMe-TCP\n> target interface could trigger a kernel crash.\n>\n>\n> [ Fix ]\n>\n> Cherry-picked from mainline for questing and noble. Adjusted for jammy\n> due to older iovec style.\n>\n>\n> [ Test Plan ]\n>\n> All three kernels were compile-tested and boot-tested. PoC verification\n> confirmed the vulnerability is no longer triggerable after the fix.\n>\n>\n> [ Where Problems Could Occur ]\n>\n> If the bounds checks are incorrect, NVMe-TCP connections could be\n> prematurely terminated or the target could become unresponsive. In the\n> worst case, a malformed check could still allow out-of-bounds access.\n>\n>\n>\nAcked-by: Masahiro Yamada <masahiro.yamada@canonical.com>","headers":{"Return-Path":"<kernel-team-bounces@lists.ubuntu.com>","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=SjZ+EY3s;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4frncD5Ntzz1yD3\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 09 Apr 2026 14:52:43 +1000 (AEST)","from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1wAhNT-0001C8-3z; Thu, 09 Apr 2026 04:52:27 +0000","from smtp-relay-internal-0.internal ([10.131.114.225]\n helo=smtp-relay-internal-0.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <masahiro.yamada@canonical.com>)\n id 1wAhNR-0001C1-S1\n for kernel-team@lists.ubuntu.com; Thu, 09 Apr 2026 04:52:25 +0000","from mail-qk1-f166.google.com (mail-qk1-f166.google.com\n [209.85.222.166])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id BCF0F3F648\n for <kernel-team@lists.ubuntu.com>; Thu,  9 Apr 2026 04:52:25 +0000 (UTC)","by mail-qk1-f166.google.com with SMTP id\n af79cd13be357-8cfc61fc9b8so37620785a.1\n for <kernel-team@lists.ubuntu.com>; Wed, 08 Apr 2026 21:52:25 -0700 (PDT)","from ?IPV6:2001:67c:1562:8007::aac:401c?\n ([2001:67c:1562:8007::aac:401c]) by smtp.gmail.com with ESMTPSA id\n 6a1803df08f44-8a5971ef80csm184938916d6.40.2026.04.08.21.52.22\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Wed, 08 Apr 2026 21:52:24 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1775710345;\n bh=tVzzFCACfbCJ0t4gOlLL7H5xKntYu2eRBRBNxorJjPA=;\n h=Message-ID:Date:MIME-Version:Subject:To:References:From:\n In-Reply-To:Content-Type;\n b=SjZ+EY3sR6t2Pk6Mmt0AqfF4DqtjooTTiDgjw1Ae7oavGbc4DMysz7+DQoH34Z170\n EFxjWenmHTFevUaFl/cVu63ahyIXIDn/HhxzCyaW7DXVIKalRH2G9dH4GojH66K959\n RSZIi6453UViLMR/iYrtM04DYW5KPFR2vVSRYrdRTFUxjab3+Sm3Qb0P/PiZZiKtjN\n mMaEo27AAehagqvcwCsU8dOBLPDGdgK+Iu/enXX6qVqC6lL831GUu6Ut8DKLGB6F/b\n eiGOIRL/3HqI9LLC1irFMoC/4Szx9R7MrFDxNLvyHKpUW40kyepMaS1ZT3hIHaArIX\n akgBOl04HrRP8XrMV9yGzXrV+WaU4Mxmx8qwiP7rcApWdgvuOjTfjJoJTRfU++FZaj\n Eyv9Ja+Tq9rtFVNuXQxZpjh4PjWG35lhAauuuhXRCFBk4GWYD5zcMlKQa72ZzSP2rr\n z97+Olecdy663UaHRJInAD7N1+tqyoKkRDx/mlyW7WtLcVej4OLMlWOYUIxI//scaC\n n13rcrR2aLF7z3qWSdvfRUegV1awGvxjoA5RKSW3umYm01ldQLldzGjf0bDFdBtkGV\n RZSF6as8icvnkYvqxpIUgQUOR29xDT5rwi3CKrfGp5iFkHRl4zGYKWBG9LyP9AR0jG\n QFQekxGbC06kKu7n/KcrQOiw=","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775710345; x=1776315145;\n h=content-transfer-encoding:in-reply-to:content-language:from\n :references:to:subject:user-agent:mime-version:date:message-id\n :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id\n :reply-to;\n bh=tVzzFCACfbCJ0t4gOlLL7H5xKntYu2eRBRBNxorJjPA=;\n b=K1CR4Gssho/rEB9EGpqg910t/24t2GZSABcXAotgl+T7eR+2j+BIfvlc2GuM6ug0KY\n IwIZB80wwp4izl4Ezfv3S0Ln0ayn47QK61YVms7c/Eu58gTCdJcLDQ0DHDFcxwmlSZtC\n TNC5yOSefI/n7T/y2kEhcp6rW5RQZoQd6P4x/QrVV5o7k55EGc1+lRv0nc/bxls5Pjn6\n 3ui2BZXaKF7PmFnAeZ5P6oPBRn5WbK9Je3ZaHaYtXeRpD0rL+zTYmEvIWI1fLXguv6oC\n 8D30WnF32dZHSiaFELVbrkTCxHDC69CxI90BP99sQgBLmbFphITw5x5vkRlD3x0sH6gb\n dUhA==","X-Forwarded-Encrypted":"i=1;\n AJvYcCVfRzWEX3ZRUp/g9C4vUl7hjS4Uzr0mk57NJrcJfDmRR+Q0HnoOUalNwn6vnVsAYXodou9RM5FcFf7igw==@lists.ubuntu.com","X-Gm-Message-State":"AOJu0Yzn295nDQi8mK1iSwXoqFxiOqr93pi+I+F0sXdH1vpqryWpYLA4\n Iu8SGDSnwl9riNj+8axmsHkpCWlAwReR/UFAHg2Z4JNeBvlJBgtuPauJHN0E85Icoz1X60IdXUv\n o7Xl1CvjCGGgy2y/HrxG/i7FButec2xOhYuZeKVXV8yR+/K4h1Tn8A3MpxH53WVtT2p/aSMCgmA\n YpOTaxhw==","X-Gm-Gg":"AeBDievz5DFl+OGfm5O5btEMXs+1VbQVj4V+tkBHOu23evjzG9eRN69pwyv3RxUnIMH\n 60hh8ckYqhn2XmV62/022Pq51nNTPG7HBCEq5hyVqHI4gl5OX+xGFNWvR4cFyFbNEWDnLCwYIg4\n JaZ8vjUALJ8zH3gs/C3ZMH9eVrNPNlPLK71n5IXEPIc5xJnJjO/z/bdGbD0DerENN1OJKmOwthK\n KFkeziYJR590Y39w2+RREaVQw5BlWRznYMVE1grigKoVVJJ4uopM9q6f+C+78/hf4p+1loHA2pp\n 33Sp3eAVe/jkjrHcGzkU0AB1PhPYeeHR4CmL4GQzDg+jdiFN9Lp+UsqZ9JRSOxVRudYqD7/CRbZ\n 85YOjbsrDdqFlskVukTbd/3gHm6wz1cjbTxXPiscVnse7Zifys74TEmUC","X-Received":["by 2002:a05:6214:f29:b0:8a0:a3fb:862c with SMTP id\n 6a1803df08f44-8a7022bbe5bmr395338976d6.8.1775710344739;\n Wed, 08 Apr 2026 21:52:24 -0700 (PDT)","by 2002:a05:6214:f29:b0:8a0:a3fb:862c with SMTP id\n 6a1803df08f44-8a7022bbe5bmr395338836d6.8.1775710344366;\n Wed, 08 Apr 2026 21:52:24 -0700 (PDT)"],"Message-ID":"<cf5e46f5-87f5-48e3-a9ea-2d6d5a9b19a2@canonical.com>","Date":"Thu, 9 Apr 2026 13:52:20 +0900","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"ACK: [SRU][Q/N/J][PATCH 0/3] CVE-2026-23112","To":"Cengiz Can <cengiz.can@canonical.com>, kernel-team@lists.ubuntu.com","References":"<177546945105.885203.15305511673780617858@nexus9.public>","From":"Masahiro Yamada <masahiro.yamada@canonical.com>","Content-Language":"en-US","In-Reply-To":"<177546945105.885203.15305511673780617858@nexus9.public>","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions <kernel-team.lists.ubuntu.com>","List-Unsubscribe":"<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>","List-Archive":"<https://lists.ubuntu.com/archives/kernel-team>","List-Post":"<mailto:kernel-team@lists.ubuntu.com>","List-Help":"<mailto:kernel-team-request@lists.ubuntu.com?subject=help>","List-Subscribe":"<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>","Content-Transfer-Encoding":"base64","Content-Type":"text/plain; charset=\"utf-8\"; Format=\"flowed\"","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>"}},{"id":3675906,"web_url":"http://patchwork.ozlabs.org/comment/3675906/","msgid":"<87tstisx34.fsf@gmail.com>","list_archive_url":null,"date":"2026-04-10T14:34:39","subject":"APPLIED: [SRU][Q/N/J][PATCH 0/3] CVE-2026-23112","submitter":{"id":89305,"url":"http://patchwork.ozlabs.org/api/people/89305/","name":"Mehmet Basaran","email":"mehmet.basaran@canonical.com"},"content":"Applied to questing:linux, noble:linux, jammy:linux master-next\nbranches. Thanks.\nCengiz Can <cengiz.can@canonical.com> writes:\n\n> https://ubuntu.com/security/CVE-2026-23112\n>\n> [ Impact ]\n>\n> nvmet_tcp_build_pdu_iovec() can walk past cmd->req.sg when a PDU length\n> or offset exceeds sg_cnt, then use bogus sg->length/offset values leading\n> to _copy_to_iter() GPF/KASAN. An attacker with access to the NVMe-TCP\n> target interface could trigger a kernel crash.\n>\n>\n> [ Fix ]\n>\n> Cherry-picked from mainline for questing and noble. Adjusted for jammy\n> due to older iovec style.\n>\n>\n> [ Test Plan ]\n>\n> All three kernels were compile-tested and boot-tested. PoC verification\n> confirmed the vulnerability is no longer triggerable after the fix.\n>\n>\n> [ Where Problems Could Occur ]\n>\n> If the bounds checks are incorrect, NVMe-TCP connections could be\n> prematurely terminated or the target could become unresponsive. In the\n> worst case, a malformed check could still allow out-of-bounds access.\n>\n>\n>\n> -- \n> kernel-team mailing list\n> kernel-team@lists.ubuntu.com\n> https://lists.ubuntu.com/mailman/listinfo/kernel-team","headers":{"Return-Path":"<kernel-team-bounces@lists.ubuntu.com>","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=HYe9ogOn;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fsfTT69hZz1y2d\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 11 Apr 2026 00:34:53 +1000 (AEST)","from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1wBCwX-0002Uy-4Q; Fri, 10 Apr 2026 14:34:45 +0000","from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <mehmet.basaran@canonical.com>)\n id 1wBCwV-0002Un-Qb\n for kernel-team@lists.ubuntu.com; Fri, 10 Apr 2026 14:34:43 +0000","from mail-wm1-f69.google.com (mail-wm1-f69.google.com\n [209.85.128.69])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id A0C483F61C\n for <kernel-team@lists.ubuntu.com>; Fri, 10 Apr 2026 14:34:43 +0000 (UTC)","by mail-wm1-f69.google.com with SMTP id\n 5b1f17b1804b1-488a75d674fso15022045e9.2\n for <kernel-team@lists.ubuntu.com>; Fri, 10 Apr 2026 07:34:43 -0700 (PDT)","from localhost ([94.54.18.154]) by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-488d538a296sm77678185e9.12.2026.04.10.07.34.41\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 10 Apr 2026 07:34:41 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1775831683;\n bh=mDSV5hEXlKqXiaL27wTtJZtEPde1ta2GatzlBjCNYOc=;\n h=From:To:Subject:In-Reply-To:References:Date:Message-ID:\n MIME-Version:Content-Type;\n b=HYe9ogOngg6/bJdy4JMvXcoN9NHMBL2wiiTokNQ7Y+E7ugvJMMgcMcM+t0D5mA25O\n XUt/bVzAunKbSVzWVqf2xHAULbt+6lTFdvG0pZBXGnhClSsmVFxYdazry3IyhLLoHG\n NwaFZS4Pou/OMHKg6VurXxvzltJhpTO4X3Hl5La09umVQ3ZSreknmMkK8OGn6HKUWN\n HsOob9ApoAYoshVxsoewzGRuAehH9wvT2YQyS3BAmmbl/eexKpK7+96nfrEpLnL3r4\n worb4VRGCwsZbcMwj/CxBRcNBgzvON1xvD+eL78OzgCaIBYNhpD4+4opWUb8vyqrlv\n 6LgOfHPBbqVnEuOGzDX/0fDZFNlxpQ3VK7+OSnWoo0NQZ2I5u1grnudflpG7bbO0eR\n 0PkFCiz6DzyQjPD0h66nrx0RzTLB3OFulhX13kpYQ6tDuNSOXt0X6NJ7fdhTvE9S9A\n nguRKCtQH4TcyLnt9dAn5X5OGWRfGncp/Nr0Waof+NOJMtTn7/GfzTF4Lrqhi7lSyE\n 4QseOsju7Wx3+YoFp1YK36JFAVjvgVnWwHyiA6cdO3mtwCgqrlZ7CDap432wlKC1tF\n ZILzdBbc50pKhUD7UO2xbqklndnaxrqpbib3m0LZEPygVZjWfdSH8xvZ8mYtx58W8+\n 5dDwRGoMrUEXtp/n4Wkhz4Gc=","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775831683; x=1776436483;\n h=mime-version:message-id:date:references:in-reply-to:subject:to:from\n :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id\n :reply-to;\n bh=mDSV5hEXlKqXiaL27wTtJZtEPde1ta2GatzlBjCNYOc=;\n b=VAltFZs6DUUU0nMu2C9AE0mP554/eHN1dBFQ94ikXI6VoM7r58WamsZkM1rVa4vtS8\n Kym9ry/9PFOM9iNx9ILdsHQaPUyQnE0hVPHxBOG+lrR7fLKyk1K3e3J4l7qYxaqTPD71\n oYgwz3i3o+3FOwSGJqL4Irz0Aq87BcUOAcxpYm9Gu8BfECEvByZGZDmrYg+dTN5s7+3q\n RFzFcJ3zWkwkXcejFn303TU30EBs3r/QlRmfGJH45KZQCH/vZi9xDb4Q7K+uaMdD79zI\n CfC1W4MNILr6scg29oB+xZYsLvKo1A9SBqYDhG/F3LUg+df0kHzx41Rf1maQSbRc2aUb\n /w8w==","X-Forwarded-Encrypted":"i=1;\n AJvYcCV8YARQm/wIhL6qhNuBFcrx+hCfXpYhe5JpFrJNI+pW8azLdiPRYK0caP/hNE/Aap/Mneb2l5VtTAn+RQ==@lists.ubuntu.com","X-Gm-Message-State":"AOJu0YygCwBSu43nB/o8caCKcAgiWGDcdTDS3xNz/BE/oeqVLNPBK26P\n Yl1+wY8NNpS6O7HgpIhGinsr4+9CANjxc2Ktl+j44pKyH103yCHRijcL5pTDl50sngD4NfvvQAt\n KEgJbNBG3DbykobRXGlBY7t7nsirOkaSGES6hPvJGVXL8AVoT+geq5dYByVbHF199TeiFoaudS6\n qgbBNaKg==","X-Gm-Gg":"AeBDieuB9qUt+lbFFYFF3Ce/igNNFB/odFggxJFwIaBKA1QE3gF0CZ8hZXp/MtL3QI2\n hn1c1aa7bFRTpRORi06GYkwt5nsp6FqdTPGwQCCNqdg8zzxQKEzKzPyTbWSJvHBPPUybUHagkHr\n pAObxCIY6zOdemGRQxd8taQXkyyYNMvsEWWNDsRwB4eafmlqQbi1cF558WjALRths9E+w87Djpf\n xIWkfXac9RwRBpTiwEI5XdT77IM6nOshx2kr50xYdsMBAPuOGf0a2O1qZIAp4j3HNaPdWxF+p7d\n 79vIsBivM7Iz+BKW2ktQ/5WeTn9ksJ2DSU1UtKaGI1IpaAZP9HFkb4esbkUM9p0t4/bVbiIpXVm\n kc91LDMxBBZlRQEuiWbpbcaQosq2O","X-Received":["by 2002:a05:600c:4504:b0:485:3b9e:caa7 with SMTP id\n 5b1f17b1804b1-488d6864f6dmr42215465e9.23.1775831683218;\n Fri, 10 Apr 2026 07:34:43 -0700 (PDT)","by 2002:a05:600c:4504:b0:485:3b9e:caa7 with SMTP id\n 5b1f17b1804b1-488d6864f6dmr42214745e9.23.1775831682660;\n Fri, 10 Apr 2026 07:34:42 -0700 (PDT)"],"From":"Mehmet Basaran <mehmet.basaran@canonical.com>","To":"Cengiz Can <cengiz.can@canonical.com>, kernel-team@lists.ubuntu.com","Subject":"APPLIED: [SRU][Q/N/J][PATCH 0/3] CVE-2026-23112","In-Reply-To":"<177546945105.885203.15305511673780617858@nexus9.public>","References":"<177546945105.885203.15305511673780617858@nexus9.public>","Date":"Fri, 10 Apr 2026 17:34:39 +0300","Message-ID":"<87tstisx34.fsf@gmail.com>","MIME-Version":"1.0","Content-Type":"multipart/mixed; boundary=\"=-=-=\"","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions <kernel-team.lists.ubuntu.com>","List-Unsubscribe":"<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>","List-Archive":"<https://lists.ubuntu.com/archives/kernel-team>","List-Post":"<mailto:kernel-team@lists.ubuntu.com>","List-Help":"<mailto:kernel-team-request@lists.ubuntu.com?subject=help>","List-Subscribe":"<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>"}}]