* [CVE-2026-80788][IMPORTANT] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
@ 2026-09-04 18:16 21% AL-KERNEL
0 siblings, 0 replies; 1+ results
From: AL-KERNEL @ 2026-09-04 18:16 UTC (permalink / raw)
To: kernel-cve
CVE: CVE-2026-80788
Priority: IMPORTANT
AL-KERNEL base severity: IMPORTANT
KPANIC flag: YES
Patch: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
Commit: 8d01f0d0e96485e39ad89b859ef85e1dc3020465
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8d01f0d0e96485e39ad89b859ef85e1dc3020465
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-80788
Analysis date: Fri, 04 Sep 2026 14:16:14 -0400
ActionableScore: 5
ActionableScore lower bound: 4
Actionable bucket: Strong Important candidate / Actionable Moderate at minimum**:: **Actionable Moderate at minimum
Manual review required: YES
Summary:
A remote NVMe/TCP initiator can trigger an oversized SGL allocation warning in `nvmet_tcp_map_data()`, which may panic the kernel on panic-on-warn systems and cause denial of service without evidence of memory corruption or privilege escalation.
======================================================================
ABOUT THIS REPORT
======================================================================
The original Linux kernel CVE announcement for CVE-2026-80788 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-80788
The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.
The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.
Published priority for this report: IMPORTANT
Manual review required: YES
A detailed explanation of the methodology and priority rules is included
at the end of this message.
======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================
CVE-2026-80788 IMPORTANT https://www.kernelcve.org/list/?q=CVE-2026-80788 CHECK WITH IMPACT FROM ORIG NN IMPORTANT Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H';CWE-789;**CWE-400;CWE-754;BEST CVSS score: '6.5';DESCR 'An oversized allocation warning in the NVMe/TCP target path can be triggered because nvmet_tcp_map_data uses a length controlled by the remote initiator when allocating scatterlist and iovec state. A remote initiator can send a command with an SGL claiming a very large size, causing allocation paths such as sgl_alloc to exceed MAX_PAGE_ORDER and trip a kernel WARN. On systems with panic-on-warn enabled this becomes a kernel panic and a denial of service. For the CVSS the PR:N because no local account on the target is required beyond reachability to the NVMe/TCP target endpoint. AV:A is used because NVMe/TCP targets are normally deployed on isolated storage or data center networks rather than directly on the public Internet. Impact is denial of service only and there is no supported UAF, OOB write, information disclosure, or privilege escalation primitive.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Strong Important candidate / Actionable Moderate at minimum (with actual score 5) MAYBE REMOTE DANGER NVME NETWORK LINUS KPANIC - - checked
======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================
ActionableScore=5
ActionableScoreLower=4
## 1. ActionableScore
* Conservative score: 4
* Paranoid score: 5
* Final recommended bucket: **Strong Important candidate / Actionable Moderate at minimum**:: **Actionable Moderate at minimum**
## 2. Signal breakdown
Conservative signals:
* Remote reachable / network-triggerable: +2. A remote NVMe/TCP initiator can influence the SGL length sent to the target.
* Reliable kernel crash / strong DoS: +1. The direct effect is a remotely triggerable WARN that becomes a kernel panic on panic-on-warn systems.
* Important filesystem/storage path: +1. The affected code is in the NVMe/TCP target storage path.
* Rare AND difficult-to-reach subsystem/configuration: -1. The target must run nvmet-tcp and expose it to the attacker, usually on an internal storage network.
* Availability impact realistic: +1. The crash is host-impacting when panic-on-warn is enabled and the trigger is simple once the NVMe/TCP target is reachable.
Paranoid adjustment:
* Do not subtract the rare/configuration penalty in paranoid scoring: +1 relative to conservative. NVMe/TCP is not Internet-common, but it is a real network storage deployment model and the trigger is remote within that environment.
No added signals:
* No memory corruption bonus. The patch only adds `__GFP_NOWARN` and does not show UAF, OOB write, double-free, object confusion, or attacker-controlled overwrite.
* No privilege escalation bonus. The supported impact is DoS only.
* No confidentiality or integrity impact. There is no read-back, data corruption, ownership bypass, or memory disclosure primitive.
## 3. Reachability analysis
The bug can be triggered by a remote NVMe/TCP initiator that can connect to the NVMe/TCP target and send a command with an oversized SGL. No local user account on the target is required, so the practical PR is PR:N for CVSS-style reasoning.
This is not a public-Internet-default service in typical deployments. NVMe/TCP targets are usually deployed inside storage, virtualization, or data-center networks. Exploitation usually requires access to that internal network or to a host allowed to act as an initiator.
Namespaces and containers do not significantly reduce the target-side privilege requirement because the attacker is remote to the target service. The key condition is network reachability to the nvmet-tcp endpoint.
## 4. Severity interpretation
This behaves like an actionable network-reachable DoS, not like an Important memory-corruption issue. The direct primitive is a remotely controlled oversized allocation request that reaches allocator warning paths. On systems with panic-on-warn enabled, this becomes a reliable kernel panic.
The theoretical worst case remains bounded because the patch context does not support UAF, OOB write, page-cache corruption, arbitrary write, or privilege escalation. Therefore the issue should not be auto-closed as ordinary Low/Moderate, but it also should not be promoted to Strong Important without additional evidence.
## 5. One-sentence report phrase
A remote NVMe/TCP initiator can trigger an oversized SGL allocation warning in `nvmet_tcp_map_data()`, which may panic the kernel on panic-on-warn systems and cause denial of service without evidence of memory corruption or privilege escalation.
## 6. Manual review recommendation
MANUAL CHECK REQUIRED.
Reason: the issue is network-triggerable against exposed NVMe/TCP targets and can become a remote kernel panic on panic-on-warn systems, even though the supported impact is DoS only.
======================================================================
UPSTREAM PATCH SUMMARY
======================================================================
Patch: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
Commit: 8d01f0d0e96485e39ad89b859ef85e1dc3020465
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8d01f0d0e96485e39ad89b859ef85e1dc3020465
Commit description:
When fuzzing the nvme target code, I tripped a kernel warning in
nvmet_tcp_map_data() because the length passed into the allocator is
controlled by the remote initiator.
A remote initiator that sends a command with an SGL claiming a huge
number, can create a scatterlist and iovec allocation of over 1 million
entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER
and then the page allocator will trip on a WARN_ON_ONCE_GFP() message:
WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof
Workqueue: nvmet_tcp_wq nvmet_tcp_io_work
...
sgl_alloc_order
nvmet_tcp_map_data
nvmet_tcp_try_recv_pdu
As it's never good to trip a kernel warning remotely due to many systems
having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to
the allocation flags.
Assisted-by: gkh_clanker_2000
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Keith Busch <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Changed files:
mm/page_alloc.c
drivers/nvme/target/tcp.c
Diff excerpt:
Not included in this email. See the upstream URL for the full patch.
Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8d01f0d0e96485e39ad89b859ef85e1dc3020465
======================================================================
DETAILED REPORT METHODOLOGY
======================================================================
The original Linux kernel CVE announcement for CVE-2026-80788 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-80788
The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.
The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.
The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.
Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:
Conservative CVSS vector: Not available
The Best / paranoid CVSS vector: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The Best / paranoid CVSS score: 6.5
The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.
CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.
A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.
Conservative ActionableScore: 4
Paranoid ActionableScore: 5
The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.
For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:
ActionableScore below 5 -> MODERATE REGULAR
ActionableScore 5 or more -> MODERATE 7.0
The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.
There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).
KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.
AL-KERNEL base severity for this report: IMPORTANT
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): IMPORTANT
These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).
Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is [email protected] (and both
send reply to CVE record itself too and see "reply" button below for howto reply).
^ permalink raw reply [relevance 21%]
Results 1-1 of 1 | reverse | sort options + mbox downloads above
-- links below jump to the message on this page --
2026-09-04 18:16 21% [CVE-2026-80788][IMPORTANT] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations AL-KERNEL
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox