CVE-2026-80788 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
A remote attacker can trigger a kernel warning via oversized SGL allocations in nvmet-tcp, potentially causing a denial of service if panic-on-warn is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80788?
CVE-2026-80788 is a denial of service vulnerability in Linux, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator.
A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message:
WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu
As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags.
Which versions are affected by CVE-2026-80788?
How do I fix CVE-2026-80788?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80788 being exploited?
There is no known exploitation of CVE-2026-80788 in the wild and no public exploit code.
Sources
Also known as AZL-99503, BELL-CVE-2026-80788, DEBIAN-CVE-2026-80788, GHSA-wcww-94r3-9q6w, UBUNTU-CVE-2026-80788.