Executive brief
The Linux kernel's NVMe target subsystem contains a heap out-of-bounds read vulnerability in its authentication negotiation handler. A malicious or misconfigured NVMe host can exploit this by sending specially crafted authentication messages with invalid buffer sizes or array indices, potentially allowing an attacker with network access to read sensitive kernel memory and enable further attacks.
Technical details
The vulnerability exists in nvmet_auth_negotiate() within drivers/nvme/target/fabrics-cmd-auth.c. The function receives an NVMe authentication message buffer but does not validate the host-supplied transfer length (tl) parameter or the hash/DH group identifier counts (halen/dhlen, both u8 up to 255) before indexing into a fixed 60-element array. An attacker can craft a message with tl smaller than the negotiate structure size or with halen/dhlen larger than the array bounds, causing the parsing loops to read past the allocated buffer. The function is called from nvmet_execute_auth_send() without passing the transfer length parameter. The fix adds transfer length validation and bounds checks on halen/dhlen values before array access. No authentication is required; the vulnerability is reachable from any network-connected NVMe host.
Affected products
- Linux Linux Kernel Linux kernel versions from 5.0 through 6.x with NVMe target support (introduced in kernel commit db1312dd9548)
Timeline
- 2026-09-17: disclosed: CVE-2026-90230 published
- 2026-08-11: patched: Upstream patch committed by Keith Busch