Linux kernel nvmet-tcp: unbounded kernel allocation from an unauthenticated NVMe/TCP peer

Impact

nvmet_tcp_map_data() only bounds the host-supplied 32-bit SGL length for the in-capsule inline descriptor type. For the transport data-block descriptor a real host uses for out-of-capsule writes, the length goes straight to sgl_alloc() unchecked, up to 4 GiB. For a write command the target answers with an R2T and parks the command, so a peer that simply never sends the data leaves the allocation resident for the life of the command, repeatable across queues and connections. NVMe/TCP has no mandatory authentication in the default configuration, so any peer that can reach the portal and complete a Fabrics connect can drive it. On a fleet where GPU nodes mount training data over an NVMe/TCP target, this is remote kernel memory exhaustion against the storage node - and pushing that node into OOM stalls every job reading from it.

Who can reach it

Any host that can reach the NVMe/TCP target portal on the storage network and complete a Fabrics connect. No authentication is required in the default configuration.

What to do

Take the stable kernel fix on every node running the NVMe-oF target (nvmet-tcp); it bounds the length against NVMET_TCP_MAXH2CDATA for every SGL descriptor type. This is a kernel change, so each target node needs a reboot onto the patched kernel unless you livepatch. Until then, restrict the target portal to known initiator addresses at the network layer and enable NVMe-oF in-band authentication where the initiators support it.

References

Related entries

• Linux kernel nvmet-auth: uninitialized slab sent to a remote initiator during NVMe-oF authenticationCVE-2026-80791 · Linux kernel nvmet-auth (DH-HMAC-CHAP AUTH_RECEIVE response buffer)Unscored
• Linux kernel io_uring: folio shift overflow writes past the bvec array on 16G-hugepage kernelsCVE-2026-80810 · Linux kernel io_uring/rsrc (registered-buffer folio shift in io_vec_fill_bvec)Unscored
• Linux kernel io_uring uring_cmd: iovec leak under NVMe passthrough once the alloc cache fillsCVE-2026-80811 · Linux kernel io_uring uring_cmd (async command iovec lifetime)Unscored
• Linux kernel nvmet: NULL dereference when a host issues Identify CNS 07h against an NVMe-oF targetCVE-2026-80813 · Linux kernel nvmet (Identify CNS 07h active namespace list handler)Unscored
• Linux kernel iommufd: NULL dereference racing IOAS change_process against a file-backed mappingCVE-2026-80817 · Linux kernel iommufd (IOAS change_process racing iopt_map_file_pages)Unscored
• Linux kernel tegra241-cmdqv: use-after-free issuing CMD_SYNC on a freed command queue at teardownCVE-2026-80818 · Linux kernel iommu/tegra241-cmdqv (NVIDIA Grace SMMUv3 command-queue virtualization)Unscored