Lucene search
+L

236 matches found

NVD
NVD
added 2026/09/16 11:17 a.m.3 views

CVE-2026-89968

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that t...

7.5CVSS
SaveExploits0References8
NVD
NVD
added 2026/09/16 11:17 a.m.2 views

CVE-2026-89969

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmettcptryrecvpdu reads a PDU header into the fixed 128-byte queue-pdu union, then computes the remaining payload length as queue-left = hdr-hlen - queue-offset ...

9.8CVSS
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.7 views

CVE-2026-89969

CVE-2026-89969 is a critical out-of-bounds write in the Linux kernel's NVMe over TCP target (nvmet-tcp) module. The function nvmet_tcp_try_recv_pdu() reads PDU data into a fixed 128-byte buffer without bounding the payload length against the buffer size. When a header digest has been negotiated a...

9.8CVSS6.1AI score
SaveExploits0References8
EUVD
EUVD
added 2026/09/16 10:32 a.m.2 views

EUVD-2026-80569

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmettcptryrecvpdu reads a PDU header into the fixed 128-byte queue-pdu union, then computes the remaining payload length as queue-left = hdr-hlen - queue-offset ...

9.8CVSS6.1AI score
SaveExploits0References8
Cvelist
Cvelist
added 2026/09/16 10:32 a.m.5 views

CVE-2026-89969 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmettcptryrecvpdu reads a PDU header into the fixed 128-byte queue-pdu union, then computes the remaining payload length as queue-left = hdr-hlen - queue-offset ...

9.8CVSS
SaveExploits0References8
EUVD
EUVD
added 2026/09/16 10:32 a.m.3 views

EUVD-2026-80568

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that t...

7.5CVSS6AI score
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.10 views

CVE-2026-89968

CVE-2026-89968 affects the Linux kernel's NVMe/TCP target (nvmet-tcp). The function nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU without verifying that the target has actually solicited the data via an R2T for that command. A remote host can exploit this by sending an H2CData PDU before...

7.5CVSS6AI score
SaveExploits0References8
Cvelist
Cvelist
added 2026/09/16 10:32 a.m.6 views

CVE-2026-89968 nvmet-tcp: reject unsolicited H2CData PDUs

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that t...

7.5CVSS
SaveExploits0References8
AstraLinux
AstraLinux
added 2026/09/14 12:01 p.m.9 views

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvmet-tcp: bounds checks were added in nvmettcpbuildpduiovec. The nvmettcpbuildpduiovec function could exceed cmd-req.sg when the PDU length or offset exceeded sgcnt, and then use bogus values of sg-length/offset. This led to...

9.8CVSS6.8AI score0.00414EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/09/11 8:27 p.m.9 views

CVE-2026-80788

A flaw was found in the Linux kernel's nvmet-tcp component. A remote attacker can send a specially crafted command with an oversized Scatter-Gather List SGL allocation. This can lead to an excessive memory allocation, triggering a kernel warning. On systems configured to panic on warnings, this...

6.2CVSS5.8AI score0.00195EPSS
SaveExploits0References4
SUSE CVE
SUSE CVE
added 2026/09/05 12:27 a.m.10 views

SUSE CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

5.9AI score0.00195EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/04 4:18 p.m.4 views

AZL-99539 CVE-2026-80789 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

6AI score0.00234EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/04 4:18 p.m.10 views

CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

0.00195EPSS
SaveExploits0References9
OSV
OSV
added 2026/09/04 4:18 p.m.4 views

AZL-99503 CVE-2026-80788 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

5.9AI score0.00195EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/04 3:13 p.m.7 views

CVE-2026-80789 nvmet-tcp: bound SGL data length before allocating command buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

5.9AI score
SaveExploits0References12
Debian CVE
Debian CVE
added 2026/09/04 3:13 p.m.11 views

CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

5.7AI score0.00234EPSS
SaveExploits0
EUVD
EUVD
added 2026/09/04 3:13 p.m.5 views

EUVD-2026-71432

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

5.7AI score0.00234EPSS
SaveExploits0References9
CVE
CVE
added 2026/09/04 3:13 p.m.13 views

CVE-2026-80789

In the Linux kernel nvmet-tcp component (NVMe/TCP target), a host-controlled 32-bit sgl->length field is only validated for in-capsule SGL descriptors. Non-inline transport SGL data-block descriptors—those used for out-of-capsule writes—skip the check entirely, causing an unbounded sgl_alloc()...

5.7AI score0.00234EPSS
SaveExploits0References9
CVE
CVE
added 2026/09/04 3:12 p.m.21 views

CVE-2026-80788

CVE-2026-80788 affects the Linux kernel NVMe-over-TCP target subsystem (nvmet-tcp ). A remote NVMe initiator can send a command with an oversized SGL (Scatter Gather List) field, causing nvmet_tcp_map_data() to allocate over one million scatterlist/iovec entries. This exceeds MAX_PAGE_ORDER , tri...

5.5AI score0.00195EPSS
SaveExploits0References9
Debian CVE
Debian CVE
added 2026/09/04 3:12 p.m.11 views

CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

5.5AI score0.00195EPSS
SaveExploits0
Rows per page
Query Builder