AZL-99503
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99503.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-99503
- Upstream
- Published
- 2026-09-04T16:18:04Z
- Modified
- 2026-09-06T05:31:44Z
- Summary
- CVE-2026-80788 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmap_data() because the length passed into the allocator is controlled by the remote initiator.
A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAXPAGEORDER and then the page allocator will trip on a WARNONONCE_GFP() message:
WARNING: mm/page_alloc.c:5280 _allocfrozenpagesnoprof Workqueue: nvmettcpwq nvmettcpiowork ... sglallocorder nvmettcpmapdata nvmettcptryrecvpdu
As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags.
- References