Executive brief
The Linux kernel's NVMe over TCP target driver can be triggered by a remote attacker to generate kernel warnings during memory allocation. Systems configured to panic on kernel warnings could be crashed remotely, denying service to NVMe storage operations.
Technical details
This vulnerability involves a denial-of-service vector in the nvmet-tcp driver's nvmet_tcp_map_data() function. The vulnerability class is resource exhaustion leading to undesired kernel warnings. When a remote initiator sends an NVMe command with a scatter-gather list (SGL) claiming an excessively large size, the kernel attempts to allocate over 1 million scatterlist and iovec entries, causing kmalloc to exceed MAX_PAGE_ORDER. This triggers a WARN_ON_ONCE_GFP() in the page allocator. The attack vector is network-based and requires only the ability to send crafted NVMe commands over TCP—no authentication or prior access needed. An attacker can remotely crash any system with panic-on-warn enabled. The fix adds GFP_NOWARN to suppress the kernel warning during allocation.
Affected products
- Linux Linux kernel multiple versions (NVMe target subsystem)
Timeline
- 2026-09-04: disclosed
- 2026-07-27: patched: Fix applied upstream and backported to stable branches