CVE-2026-23174

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23174", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.983Z", "datePublished": "2026-02-14T16:27:07.421Z", "dateUpdated": "2026-05-11T22:01:45.336Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:01:45.336Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: handle changing device dma map requirements\n\nThe initial state of dma_needs_unmap may be false, but change to true\nwhile mapping the data iterator. Enabling swiotlb is one such case that\ncan change the result. The nvme driver needs to save the mapped dma\nvectors to be unmapped later, so allocate as needed during iteration\nrather than assume it was always allocated at the beginning. This fixes\na NULL dereference from accessing an uninitialized dma_vecs when the\ndevice dma unmapping requirements change mid-iteration."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/pci.c"], "versions": [{"version": "b8b7570a7ec872f2a27b775c4f8710ca8a357adf", "lessThan": "f3ed399e9aa6f36e92d2d0fe88b387915e9705fe", "status": "affected", "versionType": "git"}, {"version": "b8b7570a7ec872f2a27b775c4f8710ca8a357adf", "lessThan": "071be3b0b6575d45be9df9c5b612f5882bfc5e88", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/pci.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.10", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f3ed399e9aa6f36e92d2d0fe88b387915e9705fe"}, {"url": "https://git.kernel.org/stable/c/071be3b0b6575d45be9df9c5b612f5882bfc5e88"}], "title": "nvme-pci: handle changing device dma map requirements", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f3ed399e9aa6f36e92d2d0fe88b387915e9705fe", "status": "affected", "version": "b8b7570a7ec872f2a27b775c4f8710ca8a357adf", "versionType": "git"}, {"lessThan": "071be3b0b6575d45be9df9c5b612f5882bfc5e88", "status": "affected", "version": "b8b7570a7ec872f2a27b775c4f8710ca8a357adf", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: handle changing device dma map requirements\n\nThe initial state of dma_needs_unmap may be false, but change to true\nwhile mapping the data iterator. Enabling swiotlb is one such case that\ncan change the result. The nvme driver needs to save the mapped dma\nvectors to be unmapped later, so allocate as needed during iteration\nrather than assume it was always allocated at the beginning. This fixes\na NULL dereference from accessing an uninitialized dma_vecs when the\ndevice dma unmapping requirements change mid-iteration."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnvme-pci: manejar los requisitos cambiantes del mapa dma del dispositivo\n\nEl estado inicial de dma_needs_unmap puede ser falso, pero cambiar a verdadero mientras se mapea el iterador de datos. Habilitar swiotlb es uno de esos casos que puede cambiar el resultado. El controlador nvme necesita guardar los vectores dma mapeados para ser desmapeados m\u00e1s tarde, as\u00ed que asignar seg\u00fan sea necesario durante la iteraci\u00f3n en lugar de asumir que siempre fue asignado al principio. Esto corrige una desreferencia NULL al acceder a un dma_vecs no inicializado cuando los requisitos de desmapeo dma del dispositivo cambian a mitad de la iteraci\u00f3n."}], "id": "CVE-2026-23174", "lastModified": "2026-06-17T10:21:02.370", "metrics": {}, "published": "2026-02-14T17:15:55.103", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/071be3b0b6575d45be9df9c5b612f5882bfc5e88"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f3ed399e9aa6f36e92d2d0fe88b387915e9705fe"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: nvme-pci: handle changing device dma map requirements", "id": "2439915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439915"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2026-23174", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23174\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23174\nhttps://lore.kernel.org/linux-cve-announce/2026021427-CVE-2026-23174-0b41@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b8b7570a7ec872f2a27b775c4f8710ca8a357adf,f3ed399e9aa6f36e92d2d0fe88b387915e9705fe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b8b7570a7ec872f2a27b775c4f8710ca8a357adf,071be3b0b6575d45be9df9c5b612f5882bfc5e88)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.10,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-18T12:16:55.674195+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that contains commit 071be3b0b6575d45be9df9c5b612f5882bfc5e88, which relocates dma_vecs allocation to occur only when needed.", "Verify that all NVMe devices are connected following best\u2011practice hardware isolation to reduce the opportunity for an attacker to stimulate uninitialized DMA mapping.", "If an immediate kernel update is infeasible, restrict NVMe device access to administrative or privileged users and monitor kernel logs for signs of NVMe\u2011related crashes or panics."], "summary": {"action": "Apply Patch", "impact": "Denial of Service via kernel crash caused by a NULL pointer dereference in the NVMe driver"}, "threat_synthesis": {"affected_systems": "All Linux kernel releases that include the NVMe PCI subsystem and that have not yet incorporated the patch that relocates the allocation of dma_vecs inside the iteration loop. The fix is referenced by the commit 071be3b0b6575d45be9df9c5b612f5882bfc5e88 in the Linux kernel source, and any system running a kernel version built from source prior to that commit is potentially vulnerable. No particular vendor or product version list is available beyond the generic Linux kernel family.", "description_and_impact": "A NULL dereference is triggered in the NVMe PCI driver when the driver\u2019s DMA mapping requirements change during a data iterator loop. The driver incorrectly assumes that the dma_vecs array is always initialized, and when the flag dma_needs_unmap flips to true, the uninitialized array causes a memory access that can crash the kernel. The resulting kernel panic leads to a loss of availability for the affected system, potentially allowing an attacker to restart the machine or disrupt critical services. The flaw is a classic NULL pointer dereference that falls under CWE\u2011476.", "risk_and_exploitability": "The CVE description does not state the attack vector. Based on the nature of the vulnerability\u2014a null pointer dereference triggered when NVMe driver DMA mapping requirements change during data iteration\u2014it is inferred that an attacker would need the ability to queue NVMe commands that cause iteration, which typically requires local privileged access. A non\u2011privileged user would normally need another privilege\u2011escalation path to affect the driver. The EPSS score is less than 1\u202f%, and the flaw is not listed in the CISA KEV catalog. Any successful exploitation would produce a kernel panic, leading to a loss of system availability. The overall risk remains low to moderate depending on the host\u2019s exposure."}}}}, "created": "2026-02-16T09:44:04.924794+00:00", "updated": "2026-04-18T12:30:45.448317+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}