Executive brief
The Linux kernel's NVMe-fabrics driver handles authentication secrets for NVMe-over-Fabric storage connections. When an invalid authentication secret is provided, the driver incorrectly fails to free temporary memory containing the secret material, leaking kernel memory with each rejected configuration. While individually small, repeated exploitation (e.g., writing bad secrets to /dev/nvme-fabrics) can degrade system stability.
Technical details
The vulnerability is a memory leak in nvmf_parse_options() in drivers/nvme/host/fabrics.c. The function duplicates DHCHAP authentication secrets using match_strdup() but fails to free the temporary string when validation of the DHHC-1: prefix fails. The temporary allocation is lost before ownership is transferred to opts, causing nvmf_free_options() to be unable to release it. Attack is local and unprivileged: an attacker can repeatedly write malformed secrets (e.g., "dhchap_secret=BAD") to /dev/nvme-fabrics to trigger the leak. The fix adds kfree_sensitive() calls before the error return paths to properly release the temporary string without leaving sensitive material in memory.
Affected products
- Linux Linux kernel Linux 5.0 and later with CONFIG_NVME_HOST_AUTH enabled
Timeline
- 2026-08-13: other: Patch authored by Xu Rao
- 2026-09-11: patched: Patch merged to Linux stable tree (commit 15d7a35a)
- 2026-09-14: patched: Patch merged to another stable branch (commit 702c1ae0)
- 2026-09-16: disclosed: Vulnerability disclosed via CVE-2026-89975