Executive brief
The Linux kernel's NVMe target authentication handler allocates a buffer without zeroing it, then sends uninitialized kernel memory to remote clients during the pre-authentication handshake. An attacker can extract sensitive data from kernel slab memory by initiating authentication and reading the leaked bytes in the response.
Technical details
The nvmet_execute_auth_receive() function in the NVMe target subsystem allocates a response buffer using kmalloc() with a size specified by the remote initiator, but only fills it with a fixed-size DH-HMAC-CHAP message. The full allocation is then copied to the wire without zeroing the unwritten tail, exposing up to nearly a full page of uninitialized kernel slab memory. A remote, unauthenticated NVMe client can trigger this by sending an AUTH_RECEIVE command with a large allocation length and reading the kernel memory leak in the response. The fix changes kmalloc() to kzalloc() to zero-initialize the buffer before sending it.
Affected products
- Linux Linux kernel all versions with nvmet in-band authentication (from v5.18)
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched