Executive brief
The Linux kernel contains a null pointer dereference vulnerability in the cryptographic multiple-precision integer (MPI) comparison function used during NVMe-over-TCP authentication. A remote attacker can trigger a kernel crash by sending specially crafted Diffie-Hellman parameters, causing a denial of service that disrupts storage network connectivity and availability.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the mpi_cmp_ui() function within lib/mpi/mpi-cmp.c. When a zeroed Diffie-Hellman value is passed during NVMeTCP authentication with the 8192-bit group selected, the function fails to validate the input before dereferencing the u->d pointer. The function previously only guarded against null when comparing with 0, but dh_is_pubkey_valid() passes 1 as the comparison value, bypassing the check. An unauthenticated remote attacker on the network can trigger this via a malformed NVMeTCP authentication handshake. The fix adds proper null checks for the MPI structure before dereferencing. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions (see stable tree commits)
Timeline
- 2025-12-09: disclosed
- 2023-09-23: patched: Patches committed to Linux kernel stable tree