Lucene search
+L

230 matches found

CVE
CVE
added 2026/09/16 10:32 a.m.4 views

CVE-2026-89969

CVE-2026-89969 is an out-of-bounds write in the Linux kernel's nvmet-tcp module (NVMe-oF Target over TCP). The function nvmet_tcp_try_recv_pdu() reads PDU payload bytes into a fixed 128-byte queue->pdu buffer without bounding the write against the buffer size. When a duplicate ICReq is receive...

6.1AI score
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.4 views

CVE-2026-89968

CVE-2026-89968 affects the nvmet-tcp (NVMe over TCP target) component in the Linux kernel . The root cause is that nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU after only validating the TTAG and buffer mapping, without checking whether the target has actually sent a Read-Ready-To-Transf...

6AI score
SaveExploits0References8
AstraLinux
AstraLinux
added 2026/09/14 12:01 p.m.9 views

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvmet-tcp: bounds checks were added in nvmettcpbuildpduiovec. The nvmettcpbuildpduiovec function could exceed cmd-req.sg when the PDU length or offset exceeded sgcnt, and then use bogus values of sg-length/offset. This led to...

9.8CVSS6.8AI score0.00414EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/09/11 8:27 p.m.9 views

CVE-2026-80788

A flaw was found in the Linux kernel's nvmet-tcp component. A remote attacker can send a specially crafted command with an oversized Scatter-Gather List SGL allocation. This can lead to an excessive memory allocation, triggering a kernel warning. On systems configured to panic on warnings, this...

6.2CVSS5.8AI score0.00195EPSS
SaveExploits0References4
SUSE CVE
SUSE CVE
added 2026/09/05 12:27 a.m.10 views

SUSE CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

5.9AI score0.00195EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/04 4:18 p.m.4 views

AZL-99539 CVE-2026-80789 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

6AI score0.00234EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/04 4:18 p.m.10 views

CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

0.00195EPSS
SaveExploits0References9
OSV
OSV
added 2026/09/04 4:18 p.m.4 views

AZL-99503 CVE-2026-80788 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

5.9AI score0.00195EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/04 3:13 p.m.7 views

CVE-2026-80789 nvmet-tcp: bound SGL data length before allocating command buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

5.9AI score
SaveExploits0References12
Debian CVE
Debian CVE
added 2026/09/04 3:13 p.m.11 views

CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

5.7AI score0.00234EPSS
SaveExploits0
EUVD
EUVD
added 2026/09/04 3:13 p.m.5 views

EUVD-2026-71432

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

5.7AI score0.00234EPSS
SaveExploits0References9
CVE
CVE
added 2026/09/04 3:13 p.m.13 views

CVE-2026-80789

In the Linux kernel nvmet-tcp component (NVMe/TCP target), a host-controlled 32-bit sgl->length field is only validated for in-capsule SGL descriptors. Non-inline transport SGL data-block descriptors—those used for out-of-capsule writes—skip the check entirely, causing an unbounded sgl_alloc()...

5.7AI score0.00234EPSS
SaveExploits0References9
CVE
CVE
added 2026/09/04 3:12 p.m.21 views

CVE-2026-80788

CVE-2026-80788 affects the Linux kernel NVMe-over-TCP target subsystem (nvmet-tcp ). A remote NVMe initiator can send a command with an oversized SGL (Scatter Gather List) field, causing nvmet_tcp_map_data() to allocate over one million scatterlist/iovec entries. This exceeds MAX_PAGE_ORDER , tri...

5.5AI score0.00195EPSS
SaveExploits0References9
Debian CVE
Debian CVE
added 2026/09/04 3:12 p.m.11 views

CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

5.5AI score0.00195EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/09/04 3:12 p.m.33 views

CVE-2026-80788 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

0.00195EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/09/04 3:12 p.m.5 views

EUVD-2026-71431

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

5.5AI score0.00195EPSS
SaveExploits0References9
OSV
OSV
added 2026/09/04 3:12 p.m.10 views

CVE-2026-80788 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

5.8AI score
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/09/04 12:00 a.m.11 views

PT-2026-85629

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmet tcp map data because the length passed into the allocator is controlled by the remote...

8.8CVSS6AI score0.00234EPSS
SaveExploits0References129
Tenable Nessus
Tenable Nessus
added 2026/09/04 12:00 a.m.9 views

Linux Distros Unpatched Vulnerability : CVE-2026-80789

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host- controlled 32-bit sgl-length and, for the in-capsule offset...

5.8AI score0.00234EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/09/04 12:00 a.m.10 views

PT-2026-85630

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmet tcp map data reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inline data size before...

5.7AI score0.00234EPSS
SaveExploits0References129
Rows per page
Query Builder