CVE-2026-80789

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: bound SGL data length before allocating command buffers

nvmet_tcp_map_data() reads the host-controlled 32-bit sgl->length

and, for the in-capsule offset descriptor (type 0x01), checks it

against port->inline_data_size before use. Any other SGL descriptor

type -- including the non-inline transport SGL data-block descriptor

(type (NVME_TRANSPORT_SGL_DATA_DESC << 4) | NVME_SGL_FMT_TRANSPORT_A,

the type a real host uses for out-of-capsule writes) skips that check

entirely and falls straight through to:

cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt);

with len taken directly from the wire, unbounded up to 4 GiB.

nvmet_req_init() only parses the command and never inspects

sgl->length, and nvmet_check_transfer_len() -- the only other place

transfer_len is validated -- runs later, from req->execute(), after

the allocation has already happened. For a write command the target

responds with an R2T and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References