{"id":"CVE-2026-98725","title":"nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to on…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 9d61131acd742cf97ee64e453383e41b46568513","Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4","Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 8a9b4c0eef19c207663c1ee888257307c869ca86","Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < fa6778e030bed9841ddcdf96bc7018da9ac03562","Linux 6.0"],"published":"2026-10-18","updated":"2026-10-19","sourceUpdated":"2026-10-19T09:24:35.936Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98725","references":[{"url":"https://git.kernel.org/stable/c/9d61131acd742cf97ee64e453383e41b46568513"},{"url":"https://git.kernel.org/stable/c/7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4"},{"url":"https://git.kernel.org/stable/c/8a9b4c0eef19c207663c1ee888257307c869ca86"},{"url":"https://git.kernel.org/stable/c/fa6778e030bed9841ddcdf96bc7018da9ac03562"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.508Z","slug":"CVE-2026-98725","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to one with GCC and undercounts the fixed\nchallenge header by 15 bytes.  A short AUTH_RECEIVE buffer can pass the\ncheck before the challenge is copied past the end of its allocation.\n\nUse the typed challenge pointer when calculating the response size.\n\n  BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  Write of size 32 by task kworker/1:1H/64\n  Workqueue: nvmet_tcp_wq nvmet_tcp_io_work\n  Call Trace:\n  nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)\n  nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)\n  process_one_work (kernel/workqueue.c:3322)\n  worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n  kthread (kernel/kthread.c:436)\n  ret_from_fork (arch/x86/kernel/process.c:158)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n  The buggy address is located 16 bytes inside of\n   allocated 33-byte region [ffff888000554e80, ffff888000554ea1)\n  Kernel panic - not syncing: KASAN: panic_on_warn set ...\n\n## Affected\n\n- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 9d61131acd742cf97ee64e453383e41b46568513`\n- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4`\n- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 8a9b4c0eef19c207663c1ee888257307c869ca86`\n- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < fa6778e030bed9841ddcdf96bc7018da9ac03562`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}