{"id":"CVE-2026-72130","title":"nvmet-auth: reject short AUTH_RECEIVE buffers","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: reject short AUTH_RECEIVE buffers\n\nnvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length\nafter checking only that it is nonzero and matches…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 80bf7b7f676e3987bbe06af3c359bd56ac91a5a9","Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 2eaa3ad450141cfcf187bb43cb8335eb336b5f87","Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < bc111698b46e43eddd8664cceaa621cd559e99a0","Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 779575bc35c687697ba69e904f2cd22e60112534","Linux 6.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T18:42:34.388225Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:44:58.498Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72130","references":[{"url":"https://git.kernel.org/stable/c/80bf7b7f676e3987bbe06af3c359bd56ac91a5a9"},{"url":"https://git.kernel.org/stable/c/2eaa3ad450141cfcf187bb43cb8335eb336b5f87"},{"url":"https://git.kernel.org/stable/c/bc111698b46e43eddd8664cceaa621cd559e99a0"},{"url":"https://git.kernel.org/stable/c/779575bc35c687697ba69e904f2cd22e60112534"}],"tags":["cve.org"],"epss":0.00748,"epssPercentile":0.53963,"ingestedAt":"2026-10-16T19:46:24.430Z","slug":"CVE-2026-72130","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: reject short AUTH_RECEIVE buffers\n\nnvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length\nafter checking only that it is nonzero and matches the transfer length.\nIn the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF\ninitiator reach the fixed-size DH-HMAC-CHAP response builders with a\nkmalloc() buffer shorter than the response, so nvmet_auth_success1() and\nnvmet_auth_failure1() write past the allocation; both only WARN_ON the\nshort length and then format the message anyway.\n\nImpact: A remote NVMe-oF initiator with access to an auth-enabled target\ncan trigger a 16-byte heap out-of-bounds write via a one-byte\nAUTH_RECEIVE allocation length.\n\nCompute the minimum response length for the current DH-HMAC-CHAP step in\nnvmet_auth_receive_data_len() and report a zero data length when the\nhost-supplied allocation length is shorter, so the existing zero-length\ncheck in nvmet_execute_auth_receive() rejects the command before any\nbuilder runs. The SUCCESS1 minimum is sizeof(struct\nnvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the\nresponse hash is written into the rval[] flexible-array tail, so the\nminimum is state dependent rather than a flat sizeof. CHALLENGE keeps its\nexisting variable-length guard in nvmet_auth_challenge().\n\nThis is reachable only when in-band DH-HMAC-CHAP authentication is\nconfigured on the target.\n\n## Affected\n\n- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 80bf7b7f676e3987bbe06af3c359bd56ac91a5a9`\n- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 2eaa3ad450141cfcf187bb43cb8335eb336b5f87`\n- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < bc111698b46e43eddd8664cceaa621cd559e99a0`\n- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 779575bc35c687697ba69e904f2cd22e60112534`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}