Linux nvmet-tcp: remote initiator can trip a kernel WARN via an oversized SGL, killing panic-on-warn hosts

Impact

The NVMe-over-TCP target trusts the SGL length sent by the remote initiator and hands it straight to sgl_alloc_order(). An initiator that claims a huge transfer makes the target attempt a scatterlist and iovec allocation of over a million entries, exceeding MAX_PAGE_ORDER and tripping WARN_ON_ONCE_GFP() in the page allocator. On a storage node built with panic_on_warn set, which is common in hardened fleets, that WARN is an immediate panic taken remotely by anything that can open a TCP connection to the target. Losing an NVMe/TCP target takes storage away from every GPU node mounting it, not just the attacker's, so the blast radius is the whole shelf rather than one tenant. The fix only adds __GFP_NOWARN, so the oversized allocation still fails, it just fails quietly.

Who can reach it

Anyone who can reach the NVMe/TCP target port, typically the storage VLAN. NVMe/TCP targets are frequently exported with no authentication, so a compromised or hostile tenant node that reaches the storage network is enough.

What to do

Update to a stable kernel carrying the fix and reboot each storage target node; the kernel CNA lists five stable branch commits but no single fixed version string, so check the branch you run against the commits below. Until the reboot, restrict which hosts can reach the target port and consider clearing panic_on_warn on target nodes so the WARN degrades to a log line rather than a panic.

References

Related entries

• Linux kernel nvmet-tcp: unbounded kernel allocation from an unauthenticated NVMe/TCP peerCVE-2026-80789 · Linux kernel nvmet-tcp (NVMe/TCP target SGL length validation)Unscored
• Linux kernel nvmet-auth: uninitialized slab sent to a remote initiator during NVMe-oF authenticationCVE-2026-80791 · Linux kernel nvmet-auth (DH-HMAC-CHAP AUTH_RECEIVE response buffer)Unscored
• Linux kernel io_uring: folio shift overflow writes past the bvec array on 16G-hugepage kernelsCVE-2026-80810 · Linux kernel io_uring/rsrc (registered-buffer folio shift in io_vec_fill_bvec)Unscored
• Linux kernel io_uring uring_cmd: iovec leak under NVMe passthrough once the alloc cache fillsCVE-2026-80811 · Linux kernel io_uring uring_cmd (async command iovec lifetime)Unscored
• Linux kernel nvmet: NULL dereference when a host issues Identify CNS 07h against an NVMe-oF targetCVE-2026-80813 · Linux kernel nvmet (Identify CNS 07h active namespace list handler)Unscored
• Linux kernel iommufd: NULL dereference racing IOAS change_process against a file-backed mappingCVE-2026-80817 · Linux kernel iommufd (IOAS change_process racing iopt_map_file_pages)Unscored