CVE-2026-80788

nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator.

A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message:

WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu

As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 8d01f0d0e96485e39ad89b859ef85e1dc3020465Affected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 7b6a54d4e7b0da423c2b53ed293fd36b16c0b19eAffected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741Affected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 86cc450022473c4a29b43a09f3ec22a9ef566dacAffected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before c509f20be1cabda3087810bb2d658d66b3f31f35Affected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 9c95f7e66c62ee6c6abedcf1c04311f430ff5833Affected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 7fd6da0f28932442b51658bac4ff55565ca9b377Affected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 9b770e40bc00381e5ebf53653de5776773415be3Affected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 737a3b535247226f6e1a7988fd9d6e63e7d6fc71Affected
LinuxLinux	5.0Affected before 5.0Not affected 5.10.267 through 5.10.Not affected 5.15.218 through 5.15.Not affected 6.1.185 through 6.1.Not affected 6.6.154 through 6.6.Not affected 6.12.106 through 6.12.Not affected 6.18.47 through 6.18.Not affected 7.1.11 through 7.1.Not affected 7.2.1 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 8d01f0d0e96485e39ad89b859ef85e1dc3020465Affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 7b6a54d4e7b0da423c2b53ed293fd36b16c0b19eAffected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741Affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 86cc450022473c4a29b43a09f3ec22a9ef566dacAffected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before c509f20be1cabda3087810bb2d658d66b3f31f35Affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 9c95f7e66c62ee6c6abedcf1c04311f430ff5833Affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 7fd6da0f28932442b51658bac4ff55565ca9b377Affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 9b770e40bc00381e5ebf53653de5776773415be3Affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 737a3b535247226f6e1a7988fd9d6e63e7d6fc71Affected

LinuxLinux

5.0Affected
before 5.0Not affected
5.10.267 through 5.10.*Not affected
5.15.218 through 5.15.*Not affected
6.1.185 through 6.1.*Not affected
6.6.154 through 6.6.*Not affected
6.12.106 through 6.12.*Not affected
6.18.47 through 6.18.*Not affected
7.1.11 through 7.1.*Not affected
7.2.1 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.