Linux kernel NVMe-oF auth heap overflow via short AUTH_RECEIVE buffer
A remote NVMe-oF initiator can supply a short-but-nonzero AUTH_RECEIVE allocation length to trigger a heap write past the allocated buffer on the nvmet target during DH-HMAC-CHAP authentication.
- Vendor
- Linux Kernel
- Product
- Linux kernel (nvmet — NVMe over Fabrics target)
- CVSS
- N/A
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
nvmet_execute_auth_receive() validated that the AUTH_RECEIVE allocation length was nonzero and matched the transfer length, but did not check that it was large enough to hold the fixed-size DH-HMAC-CHAP response structures. In the SUCCESS1 and FAILURE1 authentication states, nvmet_auth_success1() and nvmet_auth_failure1() wrote fixed-size responses into the under-sized buffer, producing a heap overflow past the kmalloc allocation.
A compromised or malicious NVMe-oF initiator on the storage fabric can trigger this against an in-kernel nvmet target. NVMe/TCP extends exposure to standard Ethernet storage networks without requiring InfiniBand. Fabric ACLs determine which hosts can reach the authentication endpoint.
The fix validates the allocation length against the minimum required response size before entering the write path. No CVSS score assigned by NVD as of publication. No exploitation in the wild confirmed. Update to the current Linux stable release; review NVMe-oF fabric ACLs to limit initiator access.
Source: kernel.org stable commit. Published on NVD 2026-08-15.
