Not yet scoredPublished Sep 4, 2026

CVE-2026-80788nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

Updated under an hour ago (Oct 27, 2026, 6:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator. A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message: WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 8d01f0d0e96485e39ad89b859ef85e1dc3020465; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e; from 872d26a391da92ed8f0c0f5cb5fef428067b7f30 before e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 86cc450022473c4a29b43a09f3ec22a9ef566dac; from 872d26a391da92ed8f0c0f5cb5fef428067b7f30 before c509f20be1cabda3087810bb2d658d66b3f31f35; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 9c95f7e66c62ee6c6abedcf1c04311f430ff5833; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 7fd6da0f28932442b51658bac4ff55565ca9b377; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 builds before 9b770e40bc00381e5ebf53653de5776773415be3; and 1 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/8d01f0d0e96485e39ad89b859ef85e1dc3020465
https://git.kernel.org/stable/c/7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e
https://git.kernel.org/stable/c/e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741
https://git.kernel.org/stable/c/86cc450022473c4a29b43a09f3ec22a9ef566dac
https://git.kernel.org/stable/c/c509f20be1cabda3087810bb2d658d66b3f31f35
https://git.kernel.org/stable/c/9c95f7e66c62ee6c6abedcf1c04311f430ff5833
https://git.kernel.org/stable/c/7fd6da0f28932442b51658bac4ff55565ca9b377
https://git.kernel.org/stable/c/9b770e40bc00381e5ebf53653de5776773415be3
https://git.kernel.org/stable/c/737a3b535247226f6e1a7988fd9d6e63e7d6fc71

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.