Executive brief
A vulnerability exists in the Linux kernel's NVMe-over-Fabrics (NVMe-oF) target implementation. A remote attacker can send a specially crafted authentication message to trigger an out-of-bounds memory read on the server. This could lead to the exposure of sensitive kernel memory or cause a system crash, potentially occurring before a user has even authenticated.
Technical details
An out-of-bounds (OOB) heap read vulnerability exists in the nvmet_auth_reply() function within the Linux kernel's NVMe target authentication module (drivers/nvme/target/fabrics-cmd-auth.c). The root cause is a failure to validate attacker-controlled fields—specifically hash length (hl) and Diffie-Hellman value length (dhvlen)—against the actual transfer length (tl) of the DHCHAP_REPLY message. A malicious initiator can craft a message with a small transfer length but large length fields, causing the kernel to read up to 526 bytes past the allocated buffer during DH public key processing or host response verification. This is exploitable pre-authentication and has been addressed by adding strict bounds validation in the nvmet_auth_reply() function.
Affected products
- Linux Linux Kernel 6.0 to 7.2-rc1
Timeline
- 2026-05-29: other: Initial patch authored
- 2026-06-03: patched: Patch committed to mainline kernel
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/3a413ece2504c70aa34a20be4dafec04e8c741f9
- https://git.kernel.org/stable/c/6d7649c1231dac14d906985d2936967e23041c26
- https://git.kernel.org/stable/c/80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0
- https://git.kernel.org/stable/c/999f6205ede984a786f35f727b01f971b98e215d
- https://git.kernel.org/stable/c/caa71b3a43ea5c13fe7141cb019ebcb03b8ac857