CVE-2026-80788
Received Received - Intake

Kernel Warning in Linux Kernel nvmet-tcp

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator. A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message: WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80788
EUVD
EUVD-2026-71431

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the nvmet-tcp module where a remote attacker can trigger a kernel warning by sending a command with an oversized scatter-gather list (SGL) allocation. The allocator receives a length value controlled by the remote initiator, leading to excessive memory allocation that exceeds system limits and triggers a WARN_ON_ONCE_GFP() message.

Detection Guidance

This vulnerability is specific to the Linux kernel's nvmet-tcp subsystem and may not have direct detection commands. Monitor kernel logs for WARN_ON_ONCE_GFP messages related to nvmet_tcp_io_work or sgl_alloc_order. Check for unusual scatterlist or iovec allocations exceeding normal sizes.

Impact Analysis

An attacker could exploit this to cause a kernel warning or potential system instability on systems with panic-on-warn enabled. This may lead to denial-of-service conditions or forced reboots, disrupting normal operations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. The patch adds GFP_NOWARN to prevent kernel warnings from remote initiators causing oversized allocations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart