CVE-2026-80789

A flaw was found in the Linux kernel's nvmet-tcp component. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted command with an oversized data length. This can lead to unbounded kernel memory allocation, causing a denial of service (DoS) due to resource exhaustion.

An unbounded allocation in the NVMe/TCP target path occurs because nvmet_tcp_map_data reads sgl length from a host supplied SGL descriptor and can pass that value to sgl_alloc before transfer length validation runs. A remote peer on the storage network can trigger this with a crafted non-inline transport SGL data-block descriptor for a write command, causing large kernel memory allocations that remain pinned while the command waits for H2C data. For the CVSS the PR:N is used because default NVMe/TCP target deployments do not require a local user account or kernel privileges once the peer can reach the target portal and complete Fabrics connect. The issue is network reachable within the NVMe/TCP storage network, but these targets are usually deployed on isolated data center or storage networks rather than the public Internet. Impact is denial of service through kernel memory exhaustion, with no evidence of information disclosure or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.