CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

When fuzzing the nvme target code, I tripped a kernel warning in nvmet tcp map data() because the length passed into the allocator is controlled by the remote initiator.

A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX PAGE ORDER and then the page allocator will trip on a WARN ON ONCE GFP() message:

WARNING: mm/page alloc.c:5280 alloc frozen pages noprof Workqueue: nvmet tcp wq nvmet tcp io work ... sgl alloc order nvmet tcp map data nvmet tcp try recv pdu

As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP NOWARN to the allocation flags.