Executive brief
The Linux kernel's NVMe over TCP implementation fails to validate the size of data buffer requests from remote clients before allocating memory. An unauthenticated attacker connecting to an NVMe storage target can send specially crafted commands that cause the kernel to allocate excessive amounts of memory (up to 4 GB per request), exhausting server resources and causing denial of service. The vulnerability requires no special privileges or authentication in default configurations.
Technical details
The vulnerability is an unbounded kernel memory allocation (CWE-400) in nvmet_tcp_map_data(). The function reads a 32-bit length value from host-controlled SGL (Scatter-Gather List) descriptors transmitted over the network without proper validation for non-inline descriptor types. While inline descriptors are checked against port->inline_data_size, non-inline transport SGL descriptors bypass this check and directly pass the untrusted length to sgl_alloc() with up to 4 GiB addressable. The attack is network-reachable; any peer able to complete an NVMe Fabrics connect can trigger allocation of large buffers that remain resident if the host never sends the promised data. The fix validates all SGL descriptor types against NVMET_TCP_MAXH2CDATA before allocation, closing the gap for non-inline descriptors while preserving tighter checks for in-capsule data.
Affected products
- Linux Linux kernel v6.19 and likely earlier versions
Timeline
- 2026-09-04: disclosed