CVE-2026-80788 Linux CVE debrief

Who should care

Linux kernel administrators and users, particularly those with systems that have panic-on-warn enabled, should assess their exposure and verify that the patch has been applied. They should review and update incident response plans for potential kernel warning events, and monitor for potential denial-of-service (DoS) attempts. Linux kernel administrators and users should also review compensating controls for exposed systems while remediation is scheduled

Why it matters

The vulnerability allows a remote initiator to cause a kernel warning in the nvmet-tcp module, potentially leading to a system panic on systems with panic-on-warn enabled. Administrators should review and apply the patch, monitor for potential DoS attempts, and assess their exposure.

• Verify and apply patch to prevent potential panic-on-warn events
• Monitor for potential denial-of-service (DoS) attempts
• Assess exposure and prioritize patching for systems with panic-on-warn enabled
• Review and update incident response plans for potential kernel warning events

Technical summary

The vulnerability is in the nvmet-tcp module of the Linux kernel. A remote initiator can cause a kernel warning by sending a command with an oversized SGL allocation. The warning occurs because the allocation exceeds MAX_PAGE_ORDER, causing the page allocator to trip on a WARN_ON_ONCE_GFP() message. The issue is resolved by adding GFP_NOWARN to the allocation flags. The vulnerability was discovered through fuzzing the nvme target code. A remote initiator can send a command with an SGL claiming a huge number, causing a scatterlist and iovec allocation of over 1 million entries. This causes the backing kmalloc call to exceed MAX_PAGE_ORDER, leading to a kernel warning. The patch adds GFP_NOWARN to the allocation

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to add GFP_NOWARN to the allocation flags in the nvmet-tcp module
• Monitor systems for potential panic-on-warn events
• Verify that panic-on-warn is disabled or mitigated on critical systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was discovered through fuzzing the nvme target code. A remote initiator can send a command with an SGL claiming a huge number, causing a scatterlist and iovec allocation of over 1 million entries. This causes the backing kmalloc call to exceed MAX_PAGE_ORDER, leading to a kernel warning.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.