CVE-2026-72130

Status: UPDATED  |  Advisory ID: CVE-2026-72130

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: reject short AUTH_RECEIVE buffers

nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length

after checking only that it is nonzero and matches the transfer length.

In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF

initiator reach the fixed-size DH-HMAC-CHAP response builders with a

kmalloc() buffer shorter than the response, so nvmet_auth_success1() and

nvmet_auth_failure1() write past the allocation; both only WARN_ON the

short length and then format the message anyway.

Impact: A remote NVMe-oF initiator with access to an auth-enabled target

can trigger a 16-byte heap out-of-bounds write via a one-byte

AUTH_RECEIVE allocation length.

Compute the minimum response length for the current DH-HMAC-CHAP step in

nvmet_auth_receive_data_len() and report a zero data length when the

host-supplied allocation length is shorter, so the existing zero-length

check in nvmet_execute_auth_receive() rejects the command before any

builder runs. The SUCCESS1 minimum is sizeof(struct

nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the

response hash is written into the rval[] flexible-array tail, so the

minimum is state dependent rather than a flat sizeof. CHALLENGE keeps its

existing variable-length guard in nvmet_auth_challenge().

This is reachable only when in-band DH-HMAC-CHAP authentication is

configured on the target. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References