CVE-2026-80788: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-80788DEBIAN-CVE-2026-80788
Published 04-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-80788 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.7% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.19%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
MGASA-2026-0506OPENSUSE-SU-2026:11773-1

Timeline

  1. 04-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator. A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message: WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

0.00 pp

From 0.19% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.107-1 | < 7.1.12-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ 872d26a391da92ed8f0c0f5cb5fef428067b7f30, < 8d01f0d0e96485e39ad89b859ef85e1dc3020465 | ≥ 872d26a391da92ed8f0c0f5cb5fef428067b7f30, < 7b6a54d4e7b0da423c2b53ed293fd36b16c0b19e | ≥ 872d26a391da92ed8f0c0f5cb5fef428067b7f30, < e7077e6c45423dd2bb7de7b5fc4b018a8e6c4741 | ≥ 872d26a391da92ed8f0c0f5cb5fef428067b7f30, < 86cc450022473c4a29b43a09f3ec22a9ef566dac | ≥ 872d26a391da92ed8f0c0f5cb5fef428067b7f30, < c509f20be1cabda3087810bb2d658d66b3f31f35 | ≥ 872d26a391da92ed8f0c0f5cb5fef428067b7f30, < 9c95f7e66c62ee6c6abedcf1c04311f430ff5833 | ≥ 872d26a391da92ed8f0c0f5cb5fef428067b7f30, < 7fd6da0f28932442b51658bac4ff55565ca9b377 | ≥ 872d26a391da92ed8f0c0f5cb5fef428067b7f30, < 9b770e40bc00381e5ebf53653de5776773415be3 | ≥ 872d26a391da92ed8f0c0f5cb5fef428067b7f30, < 737a3b535247226f6e1a7988fd9d6e63e7d6fc71 | 5.0

3 vendors · 172 products

References

14 links
Show all 14 references