CVE-2026-80788nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator. A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message: WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 8d01f0d0e96485e39ad89b859ef85e1dc3020465; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e; from 872d26a391da92ed8f0c0f5cb5fef428067b7f30 before e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 86cc450022473c4a29b43a09f3ec22a9ef566dac; from 872d26a391da92ed8f0c0f5cb5fef428067b7f30 before c509f20be1cabda3087810bb2d658d66b3f31f35; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 9c95f7e66c62ee6c6abedcf1c04311f430ff5833; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 7fd6da0f28932442b51658bac4ff55565ca9b377; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 9b770e40bc00381e5ebf53653de5776773415be3; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/8d01f0d0e96485e39ad89b859ef85e1dc3020465
- https://git.kernel.org/stable/c/7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e
- https://git.kernel.org/stable/c/e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741
- https://git.kernel.org/stable/c/86cc450022473c4a29b43a09f3ec22a9ef566dac
- https://git.kernel.org/stable/c/c509f20be1cabda3087810bb2d658d66b3f31f35
- https://git.kernel.org/stable/c/9c95f7e66c62ee6c6abedcf1c04311f430ff5833
- https://git.kernel.org/stable/c/7fd6da0f28932442b51658bac4ff55565ca9b377
- https://git.kernel.org/stable/c/9b770e40bc00381e5ebf53653de5776773415be3
- https://git.kernel.org/stable/c/737a3b535247226f6e1a7988fd9d6e63e7d6fc71
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.