CVE-2026-72130

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: reject short AUTH_RECEIVE buffers

nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length

after checking only that it is nonzero and matches the transfer length.

In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF

initiator reach the fixed-size DH-HMAC-CHAP response builders with a

kmalloc() buffer shorter than the response, so nvmet_auth_success1() and

nvmet_auth_failure1() write past the allocation; both only WARN_ON the

short length and then format the message anyway.

Impact: A remote NVMe-oF initiator with access to an auth-enabled target

can trigger a 16-byte heap out-of-bounds write via a one-byte

AUTH_RECEIVE allocation length.

Compute the minimum response length for the current DH-HMAC-CHAP step in

nvmet_auth_receive_data_len() and report a zero data length when the

host-supplied allocation length is shorter, so the existing zero-length

check in nvmet_execute_a

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References