Prior report for the nvmet-tcp unbounded SGL length fix in 7.3

[Shivam Kumar]

Hi Greg,

Just the CVE, if one is assigned to 4a3f002, being recorded as the
reporter would be all I'm after.

Thanks,
Shivam

On Mon, Aug 24, 2026 at 12:01 PM Greg Kroah-Hartman
<gregkh at linuxfoundation.org> wrote:
>
> On Mon, Aug 24, 2026 at 11:42:50AM -0400, Shivam Kumar wrote:
> > Hi all,
> >
> > I originally reported this issue to security at kernel.org on 2026-03-17
> > (Cc Sagi), Message-ID:
> > <CA+ysrSJUFi8cHzU8g9Nrbbkcuo0F7vh8CMn3ht15gSk3BbK45A at mail.gmail.com>
> > and posted the first patch for it in this thread,
> > "[PATCH] nvmet-tcp: bound sgl->length check in nvmet_tcp_map_data()"
> > (2026-03-19).
> >
> > Commit 4a3f002 ("nvmet-tcp: bound SGL data length before allocating
> > command buffers"), merged for 7.3, adds the same NVMET_TCP_MAXH2CDATA
> > bound with the same status code.
> >
> > These things happen independently, and I'm glad the issue is fixed.
> > Would it be possible to get some acknowledgement for the original
> > report?
>
> "acknowledgment" in what way?  If the patch is merged, what can we do
> here?
>
> thanks,
>
> greg k-h