CVE-2026-80788
Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator. A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message: WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags.
How to fix
- Linux Linux8d01f0d0e96485e39ad89b859ef85e1dc3020465, 7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e, e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741, 86cc450022473c4a29b43a09f3ec22a9ef566dac, c509f20be1cabda3087810bb2d658d66b3f31f35, 9c95f7e66c62ee6c6abedcf1c04311f430ff5833, 7fd6da0f28932442b51658bac4ff55565ca9b377, 9b770e40bc00381e5ebf53653de5776773415be3, 737a3b535247226f6e1a7988fd9d6e63e7d6fc71 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 872d26a391da92ed8f0c0f5cb5fef428067b7f30 ≤ v < 8d01f0d0e96485e39ad89b859ef85e1dc3020465, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 ≤ v < 7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 ≤ v < e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 ≤ v < 86cc450022473c4a29b43a09f3ec22a9ef566dac, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 ≤ v < c509f20be1cabda3087810bb2d658d66b3f31f35, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 ≤ v < 9c95f7e66c62ee6c6abedcf1c04311f430ff5833, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 ≤ v < 7fd6da0f28932442b51658bac4ff55565ca9b377, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 ≤ v < 9b770e40bc00381e5ebf53653de5776773415be3, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 ≤ v < 737a3b535247226f6e1a7988fd9d6e63e7d6fc71, 5.0 | 8d01f0d0e96485e39ad89b859ef85e1dc3020465, 7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e, e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741, 86cc450022473c4a29b43a09f3ec22a9ef566dac, c509f20be1cabda3087810bb2d658d66b3f31f35, 9c95f7e66c62ee6c6abedcf1c04311f430ff5833, 7fd6da0f28932442b51658bac4ff55565ca9b377, 9b770e40bc00381e5ebf53653de5776773415be3, 737a3b535247226f6e1a7988fd9d6e63e7d6fc71 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.