GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80789 (GCVE-0-2026-80789)

Vulnerability from cvelistv5 – Published: 2026-09-04 15:13 – Updated: 2026-09-04 15:13
VLAI
Title
nvmet-tcp: bound SGL data length before allocating command buffers
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmet_tcp_map_data() reads the host-controlled 32-bit sgl->length and, for the in-capsule offset descriptor (type 0x01), checks it against port->inline_data_size before use. Any other SGL descriptor type -- including the non-inline transport SGL data-block descriptor (type (NVME_TRANSPORT_SGL_DATA_DESC << 4) | NVME_SGL_FMT_TRANSPORT_A, the type a real host uses for out-of-capsule writes) skips that check entirely and falls straight through to: cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt); with len taken directly from the wire, unbounded up to 4 GiB. nvmet_req_init() only parses the command and never inspects sgl->length, and nvmet_check_transfer_len() -- the only other place transfer_len is validated -- runs later, from req->execute(), after the allocation has already happened. For a write command the target responds with an R2T and parks the command waiting for the host to send the data; if the host (or an unauthenticated peer that simply never follows up) never does, the sgl_alloc() buffer stays resident for the life of the command. NVMe/TCP has no mandatory authentication in the default configuration, so any peer able to reach the target portal and complete a Fabrics connect can drive this with a single crafted command, repeatable across queues and connections for amplification. This is unbounded kernel memory allocation triggered by a remote, effectively unauthenticated peer. Validate len against the same NVMET_TCP_MAXH2CDATA ceiling this file already uses to bound per-PDU H2C data, for every SGL descriptor type, before doing any allocation. This closes the gap for the non-inline descriptor while leaving the existing, tighter inline_data_size check in place for the in-capsule case. Runtime-verified on a v6.19 KASAN stand: with this bound in place, a crafted write command carrying an oversized non-inline SGL length is rejected before sgl_alloc() runs, where the same request previously drove an unbounded ~256 MiB kernel allocation (up to 4 GiB) that stayed resident pending an R2T the host never satisfies.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < f6e51b09cbaa5f6f6e6a3a9dafa666f76c37aab5 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < f63e89a0310264264923f84406dea05fe752de62 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 0952541b153e258b99d39cdb03ea6919fdeb41d0 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 25ad03d5c0e858c4b63f1e4b6d461d2af1b30b22 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < d2acc96c528d589f5827cfb90e8e9229dd9d8cb4 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 6d27199ebe8cb223022150f74be13f154a964474 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 14dbe37681a6a7e346fc147bb363ec7cca3180a0 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < d895e66628f939edbb98608f6e033d3d39e6e546 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 4a3f00262a044e8e15064b1a6860968bf0500bf4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.10.269 , ≤ 5.10.* (semver)
Unaffected: 5.15.220 , ≤ 5.15.* (semver)
Unaffected: 6.1.187 , ≤ 6.1.* (semver)
Unaffected: 6.6.156 , ≤ 6.6.* (semver)
Unaffected: 6.12.106 , ≤ 6.12.* (semver)
Unaffected: 6.18.47 , ≤ 6.18.* (semver)
Unaffected: 7.1.11 , ≤ 7.1.* (semver)
Unaffected: 7.2.1 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6e51b09cbaa5f6f6e6a3a9dafa666f76c37aab5",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "f63e89a0310264264923f84406dea05fe752de62",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "0952541b153e258b99d39cdb03ea6919fdeb41d0",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "25ad03d5c0e858c4b63f1e4b6d461d2af1b30b22",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "d2acc96c528d589f5827cfb90e8e9229dd9d8cb4",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "6d27199ebe8cb223022150f74be13f154a964474",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "14dbe37681a6a7e346fc147bb363ec7cca3180a0",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "d895e66628f939edbb98608f6e033d3d39e6e546",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "4a3f00262a044e8e15064b1a6860968bf0500bf4",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.269",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.220",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.187",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.156",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: bound SGL data length before allocating command buffers\n\nnvmet_tcp_map_data() reads the host-controlled 32-bit sgl-\u003elength\nand, for the in-capsule offset descriptor (type 0x01), checks it\nagainst port-\u003einline_data_size before use. Any other SGL descriptor\ntype -- including the non-inline transport SGL data-block descriptor\n(type (NVME_TRANSPORT_SGL_DATA_DESC \u003c\u003c 4) | NVME_SGL_FMT_TRANSPORT_A,\nthe type a real host uses for out-of-capsule writes) skips that check\nentirely and falls straight through to:\n\n\tcmd-\u003ereq.sg = sgl_alloc(len, GFP_KERNEL, \u0026cmd-\u003ereq.sg_cnt);\n\nwith len taken directly from the wire, unbounded up to 4 GiB.\n\nnvmet_req_init() only parses the command and never inspects\nsgl-\u003elength, and nvmet_check_transfer_len() -- the only other place\ntransfer_len is validated -- runs later, from req-\u003eexecute(), after\nthe allocation has already happened. For a write command the target\nresponds with an R2T and parks the command waiting for the host to\nsend the data; if the host (or an unauthenticated peer that simply\nnever follows up) never does, the sgl_alloc() buffer stays resident\nfor the life of the command. NVMe/TCP has no mandatory authentication\nin the default configuration, so any peer able to reach the target\nportal and complete a Fabrics connect can drive this with a single\ncrafted command, repeatable across queues and connections for\namplification. This is unbounded kernel memory allocation\ntriggered by a remote, effectively unauthenticated peer.\n\nValidate len against the same NVMET_TCP_MAXH2CDATA ceiling this file\nalready uses to bound per-PDU H2C data, for every SGL descriptor type,\nbefore doing any allocation. This closes the gap for the non-inline\ndescriptor while leaving the existing, tighter inline_data_size check\nin place for the in-capsule case.\n\nRuntime-verified on a v6.19 KASAN stand: with this bound in place, a\ncrafted write command carrying an oversized non-inline SGL length is\nrejected before sgl_alloc() runs, where the same request previously\ndrove an unbounded ~256 MiB kernel allocation (up to 4 GiB) that\nstayed resident pending an R2T the host never satisfies."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T15:13:01.161Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6e51b09cbaa5f6f6e6a3a9dafa666f76c37aab5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f63e89a0310264264923f84406dea05fe752de62"
        },
        {
          "url": "https://git.kernel.org/stable/c/0952541b153e258b99d39cdb03ea6919fdeb41d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/25ad03d5c0e858c4b63f1e4b6d461d2af1b30b22"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2acc96c528d589f5827cfb90e8e9229dd9d8cb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d27199ebe8cb223022150f74be13f154a964474"
        },
        {
          "url": "https://git.kernel.org/stable/c/14dbe37681a6a7e346fc147bb363ec7cca3180a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d895e66628f939edbb98608f6e033d3d39e6e546"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a3f00262a044e8e15064b1a6860968bf0500bf4"
        }
      ],
      "title": "nvmet-tcp: bound SGL data length before allocating command buffers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80789",
    "datePublished": "2026-09-04T15:13:01.161Z",
    "dateReserved": "2026-08-26T14:34:25.793Z",
    "dateUpdated": "2026-09-04T15:13:01.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80789",
      "date": "2026-09-18",
      "epss": "0.00234",
      "percentile": "0.14643"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-07T01:49:15.000Z",
      "cve": "CVE-2026-80789",
      "id": "msrc_CVE-2026-80789",
      "initial_release_date": "2026-09-06T05:08:37.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nvmet-tcp: bound SGL data length before allocating command buffers",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80789.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/tcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f6e51b09cbaa5f6f6e6a3a9dafa666f76c37aab5",
                    "status": "affected",
                    "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f63e89a0310264264923f84406dea05fe752de62",
                    "status": "affected",
                    "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0952541b153e258b99d39cdb03ea6919fdeb41d0",
                    "status": "affected",
                    "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "25ad03d5c0e858c4b63f1e4b6d461d2af1b30b22",
                    "status": "affected",
                    "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d2acc96c528d589f5827cfb90e8e9229dd9d8cb4",
                    "status": "affected",
                    "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6d27199ebe8cb223022150f74be13f154a964474",
                    "status": "affected",
                    "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "14dbe37681a6a7e346fc147bb363ec7cca3180a0",
                    "status": "affected",
                    "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d895e66628f939edbb98608f6e033d3d39e6e546",
                    "status": "affected",
                    "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4a3f00262a044e8e15064b1a6860968bf0500bf4",
                    "status": "affected",
                    "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/tcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.0"
                  },
                  {
                    "lessThan": "5.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.269",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.220",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.187",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.156",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.106",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.47",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: bound SGL data length before allocating command buffers\n\nnvmet_tcp_map_data() reads the host-controlled 32-bit sgl-\u003elength\nand, for the in-capsule offset descriptor (type 0x01), checks it\nagainst port-\u003einline_data_size before use. Any other SGL descriptor\ntype -- including the non-inline transport SGL data-block descriptor\n(type (NVME_TRANSPORT_SGL_DATA_DESC \u003c\u003c 4) | NVME_SGL_FMT_TRANSPORT_A,\nthe type a real host uses for out-of-capsule writes) skips that check\nentirely and falls straight through to:\n\n\tcmd-\u003ereq.sg = sgl_alloc(len, GFP_KERNEL, \u0026cmd-\u003ereq.sg_cnt);\n\nwith len taken directly from the wire, unbounded up to 4 GiB.\n\nnvmet_req_init() only parses the command and never inspects\nsgl-\u003elength, and nvmet_check_transfer_len() -- the only other place\ntransfer_len is validated -- runs later, from req-\u003eexecute(), after\nthe allocation has already happened. For a write command the target\nresponds with an R2T and parks the command waiting for the host to\nsend the data; if the host (or an unauthenticated peer that simply\nnever follows up) never does, the sgl_alloc() buffer stays resident\nfor the life of the command. NVMe/TCP has no mandatory authentication\nin the default configuration, so any peer able to reach the target\nportal and complete a Fabrics connect can drive this with a single\ncrafted command, repeatable across queues and connections for\namplification. This is unbounded kernel memory allocation\ntriggered by a remote, effectively unauthenticated peer.\n\nValidate len against the same NVMET_TCP_MAXH2CDATA ceiling this file\nalready uses to bound per-PDU H2C data, for every SGL descriptor type,\nbefore doing any allocation. This closes the gap for the non-inline\ndescriptor while leaving the existing, tighter inline_data_size check\nin place for the in-capsule case.\n\nRuntime-verified on a v6.19 KASAN stand: with this bound in place, a\ncrafted write command carrying an oversized non-inline SGL length is\nrejected before sgl_alloc() runs, where the same request previously\ndrove an unbounded ~256 MiB kernel allocation (up to 4 GiB) that\nstayed resident pending an R2T the host never satisfies."
          }
        ],
        "id": "CVE-2026-80789",
        "lastModified": "2026-09-04T16:18:05.010",
        "metrics": {},
        "published": "2026-09-04T16:18:05.010",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0952541b153e258b99d39cdb03ea6919fdeb41d0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/14dbe37681a6a7e346fc147bb363ec7cca3180a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/25ad03d5c0e858c4b63f1e4b6d461d2af1b30b22"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4a3f00262a044e8e15064b1a6860968bf0500bf4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6d27199ebe8cb223022150f74be13f154a964474"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d2acc96c528d589f5827cfb90e8e9229dd9d8cb4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d895e66628f939edbb98608f6e033d3d39e6e546"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f63e89a0310264264923f84406dea05fe752de62"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f6e51b09cbaa5f6f6e6a3a9dafa666f76c37aab5"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:08:32Z",
      "cve": "CVE-2026-80789",
      "id": "CVE-2026-80789",
      "initial_release_date": "2026-09-05T00:27:22Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80789",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80789.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.