HIGH Introduced in 5.0
nvmet-tcp SglAlloc Panic
CVE-2026-80788
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator. A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message: WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags.
02KernelScan AI Analysis
Risk summary
A remote, unauthenticated attacker who can reach an NVMe-oF TCP target can send a command with an oversized scatter-gather list that triggers a kernel warning in the page allocator. On systems with panic_on_warn enabled, this causes a kernel panic, resulting in a complete denial of service. Any host running the NVMe-oF TCP target with network exposure is at risk.
Vulnerability analysis
When the NVMe storage target receives a command over TCP, it allocates memory based on the size claimed by the remote sender. A malicious sender can claim an enormous size, causing the kernel to attempt an allocation so large that it triggers an internal warning. On systems configured to treat warnings as fatal, this causes an immediate crash. The fix changes the allocation behavior so that oversized requests fail silently instead of triggering a warning, allowing the existing error handling to reject the command cleanly. Any network client that can reach the target port can trigger this; no authentication or special privileges are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.0 | 5.15.218 | 7b6a54d4e7b0 |
| 6.18 | 5.0 | 6.18.47 | 9c95f7e66c62 |
| 7.2 | 5.0 | 7.2.1 | 9b770e40bc00 |
| mainline | 5.0 | 7.3-rc1 | 737a3b535247 |
| 7.1 | 5.0 | 7.1.11 | 7fd6da0f2893 |
| 6.6 | 5.0 | 6.6.154 | 86cc45002247 |
| 5.10 | 5.0 | 5.10.267 | 8d01f0d0e964 |
| 6.12 | 5.0 | 6.12.106 | c509f20be1ca |
| 6.1 | 5.0 | 6.1.185 | e7077e6c4542 |
| cip/5.10 | 5.0 | 5.10.268-cip77 | 8d01f0d0e964 |
| cip/5.10-rt | 5.0 | 5.10.268-cip77-rt34 | 8d01f0d0e964 |
| cip/6.1 | 5.0 | 6.1.187-cip60 | e7077e6c4542 |
| cip/6.12 | 5.0 | 6.12.108-cip31 | c509f20be1ca |