{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72130","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.907Z","datePublished":"2026-08-15T05:53:06.604Z","dateUpdated":"2026-08-17T05:40:42.219Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:40:42.219Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: reject short AUTH_RECEIVE buffers\n\nnvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length\nafter checking only that it is nonzero and matches the transfer length.\nIn the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF\ninitiator reach the fixed-size DH-HMAC-CHAP response builders with a\nkmalloc() buffer shorter than the response, so nvmet_auth_success1() and\nnvmet_auth_failure1() write past the allocation; both only WARN_ON the\nshort length and then format the message anyway.\n\nImpact: A remote NVMe-oF initiator with access to an auth-enabled target\ncan trigger a 16-byte heap out-of-bounds write via a one-byte\nAUTH_RECEIVE allocation length.\n\nCompute the minimum response length for the current DH-HMAC-CHAP step in\nnvmet_auth_receive_data_len() and report a zero data length when the\nhost-supplied allocation length is shorter, so the existing zero-length\ncheck in nvmet_execute_auth_receive() rejects the command before any\nbuilder runs. The SUCCESS1 minimum is sizeof(struct\nnvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the\nresponse hash is written into the rval[] flexible-array tail, so the\nminimum is state dependent rather than a flat sizeof. CHALLENGE keeps its\nexisting variable-length guard in nvmet_auth_challenge().\n\nThis is reachable only when in-band DH-HMAC-CHAP authentication is\nconfigured on the target."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in nvmet DH-HMAC-CHAP AUTH_RECEIVE handling reached by remote NVMe-oF initiators over network transports (nvmet-tcp/RDMA/FC); malicious allocation length arrives in a Fabrics command capsule from the network.\nAC:L - Once an auth-enabled target is reachable, the attacker fully controls AUTH_RECEIVE allocation length and can reliably reach vulnerable states (e.g. default NEGOTIATE branch or FAILURE1) without conditions beyond their control.\nPR:N - Exploitation occurs on the pre-authentication DH-HMAC-CHAP handshake before credentials are verified; no Linux privileges on the target are required, only network access to an auth-configured NVMe-oF target port.\nUI:N - No victim user action is required beyond the administrator having already deployed an NVMe-oF target; exploitation is driven entirely by attacker-sent Fabrics authentication commands.\nS:U - Impact is kernel heap memory corruption within the NVMe target subsystem on the same host; it does not cross a VM/hypervisor or IOMMU security boundary by itself.\nC:H - A controlled heap out-of-bounds write (up to 16 bytes plus optional HMAC tail in SUCCESS1) can corrupt adjacent kmalloc objects and be leveraged for kernel information disclosure, per memory-corruption guidance.\nI:H - The vulnerability is a heap out-of-bounds write in kernel context; such corruption is exploitable for arbitrary memory modification and potential code execution, not merely a bounded logic error.\nA:H - Heap corruption can cause kernel oops/panic, and the FAILURE1 AUTH_RECEIVE completion path calls nvmet_ctrl_fatal_error(), taking down the NVMe controller and denying service to connected initiators."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/fabrics-cmd-auth.c"],"versions":[{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"80bf7b7f676e3987bbe06af3c359bd56ac91a5a9","status":"affected","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"2eaa3ad450141cfcf187bb43cb8335eb336b5f87","status":"affected","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"bc111698b46e43eddd8664cceaa621cd559e99a0","status":"affected","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"779575bc35c687697ba69e904f2cd22e60112534","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/fabrics-cmd-auth.c"],"versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/80bf7b7f676e3987bbe06af3c359bd56ac91a5a9"},{"url":"https://git.kernel.org/stable/c/2eaa3ad450141cfcf187bb43cb8335eb336b5f87"},{"url":"https://git.kernel.org/stable/c/bc111698b46e43eddd8664cceaa621cd559e99a0"},{"url":"https://git.kernel.org/stable/c/779575bc35c687697ba69e904f2cd22e60112534"}],"title":"nvmet-auth: reject short AUTH_RECEIVE buffers","x_generator":{"engine":"bippy-1.2.0"}}}}