---
id: CVE-2026-80788
title: 'nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

  When fuzzing the nvme target code, I tripped a kernel warning in
  nvmet_tcp_map_data() because t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 <
    8d01f0d0e96485e39ad89b859ef85e1dc3020465
  - >-
    Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 <
    7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e
  - >-
    Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 <
    e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741
  - >-
    Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 <
    86cc450022473c4a29b43a09f3ec22a9ef566dac
  - >-
    Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 <
    c509f20be1cabda3087810bb2d658d66b3f31f35
  - >-
    Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 <
    9c95f7e66c62ee6c6abedcf1c04311f430ff5833
  - >-
    Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 <
    7fd6da0f28932442b51658bac4ff55565ca9b377
  - >-
    Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 <
    9b770e40bc00381e5ebf53653de5776773415be3
  - >-
    Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 <
    737a3b535247226f6e1a7988fd9d6e63e7d6fc71
  - Linux 5.0
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:43:40.496Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80788'
references:
  - url: 'https://git.kernel.org/stable/c/8d01f0d0e96485e39ad89b859ef85e1dc3020465'
  - url: 'https://git.kernel.org/stable/c/7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e'
  - url: 'https://git.kernel.org/stable/c/e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741'
  - url: 'https://git.kernel.org/stable/c/86cc450022473c4a29b43a09f3ec22a9ef566dac'
  - url: 'https://git.kernel.org/stable/c/c509f20be1cabda3087810bb2d658d66b3f31f35'
  - url: 'https://git.kernel.org/stable/c/9c95f7e66c62ee6c6abedcf1c04311f430ff5833'
  - url: 'https://git.kernel.org/stable/c/7fd6da0f28932442b51658bac4ff55565ca9b377'
  - url: 'https://git.kernel.org/stable/c/9b770e40bc00381e5ebf53653de5776773415be3'
  - url: 'https://git.kernel.org/stable/c/737a3b535247226f6e1a7988fd9d6e63e7d6fc71'
tags:
  - cve.org
epss: 0.00195
epssPercentile: 0.08587
ingestedAt: '2026-10-19T10:20:54.957Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

When fuzzing the nvme target code, I tripped a kernel warning in
nvmet_tcp_map_data() because the length passed into the allocator is
controlled by the remote initiator.

A remote initiator that sends a command with an SGL claiming a huge
number, can create a scatterlist and iovec allocation of over 1 million
entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER
and then the page allocator will trip on a WARN_ON_ONCE_GFP() message:

  WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof
  Workqueue: nvmet_tcp_wq nvmet_tcp_io_work
  ...
  sgl_alloc_order
  nvmet_tcp_map_data
  nvmet_tcp_try_recv_pdu

As it's never good to trip a kernel warning remotely due to many systems
having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to
the allocation flags.

## Affected

- `Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 8d01f0d0e96485e39ad89b859ef85e1dc3020465`
- `Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e`
- `Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741`
- `Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 86cc450022473c4a29b43a09f3ec22a9ef566dac`
- `Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < c509f20be1cabda3087810bb2d658d66b3f31f35`
- `Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 9c95f7e66c62ee6c6abedcf1c04311f430ff5833`
- `Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 7fd6da0f28932442b51658bac4ff55565ca9b377`
- `Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 9b770e40bc00381e5ebf53653de5776773415be3`
- `Linux >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 737a3b535247226f6e1a7988fd9d6e63e7d6fc71`
- `Linux 5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.