CVE-2026-80788

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the nvmet-tcp module where a remote initiator can trigger a kernel warning. By sending a command with a Scatter Gather List (SGL) claiming an excessively large number, the initiator can force the allocation of a scatterlist and iovec exceeding 1 million entries. This causes the backing kmalloc call to exceed MAX PAGE ORDER, triggering a WARN ON ONCE GFP() message in the nvmet tcp map data() function. On systems where panic-on-warn is enabled, this can lead to a system crash. The issue involves the nvmet tcp map data(), nvmet tcp try recv pdu(), and sgl alloc order() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.