https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 12:48:26 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80788 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations</p> <p>When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator.</p> <p>A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message:</p> <p>WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu</p> <p>As it&#39;s never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let&#39;s silence it by just add GFP_NOWARN to the allocation flags.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations</p> <p>When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator.</p> <p>A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message:</p> <p>WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu</p> <p>As it&#39;s never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let&#39;s silence it by just add GFP_NOWARN to the allocation flags.</p> https://vulnerability.circl.lu/vuln/cve-2026-80788