---
id: CVE-2026-72130
title: 'nvmet-auth: reject short AUTH_RECEIVE buffers'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvmet-auth: reject short AUTH_RECEIVE buffers

  nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length
  after checking only that it is nonzero and matches…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 <
    80bf7b7f676e3987bbe06af3c359bd56ac91a5a9
  - >-
    Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 <
    2eaa3ad450141cfcf187bb43cb8335eb336b5f87
  - >-
    Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 <
    bc111698b46e43eddd8664cceaa621cd559e99a0
  - >-
    Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 <
    779575bc35c687697ba69e904f2cd22e60112534
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:42:34.388225Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:44:58.498Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72130'
references:
  - url: 'https://git.kernel.org/stable/c/80bf7b7f676e3987bbe06af3c359bd56ac91a5a9'
  - url: 'https://git.kernel.org/stable/c/2eaa3ad450141cfcf187bb43cb8335eb336b5f87'
  - url: 'https://git.kernel.org/stable/c/bc111698b46e43eddd8664cceaa621cd559e99a0'
  - url: 'https://git.kernel.org/stable/c/779575bc35c687697ba69e904f2cd22e60112534'
tags:
  - cve.org
epss: 0.00748
epssPercentile: 0.53963
ingestedAt: '2026-10-16T19:46:24.430Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: reject short AUTH_RECEIVE buffers

nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length
after checking only that it is nonzero and matches the transfer length.
In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF
initiator reach the fixed-size DH-HMAC-CHAP response builders with a
kmalloc() buffer shorter than the response, so nvmet_auth_success1() and
nvmet_auth_failure1() write past the allocation; both only WARN_ON the
short length and then format the message anyway.

Impact: A remote NVMe-oF initiator with access to an auth-enabled target
can trigger a 16-byte heap out-of-bounds write via a one-byte
AUTH_RECEIVE allocation length.

Compute the minimum response length for the current DH-HMAC-CHAP step in
nvmet_auth_receive_data_len() and report a zero data length when the
host-supplied allocation length is shorter, so the existing zero-length
check in nvmet_execute_auth_receive() rejects the command before any
builder runs. The SUCCESS1 minimum is sizeof(struct
nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the
response hash is written into the rval[] flexible-array tail, so the
minimum is state dependent rather than a flat sizeof. CHALLENGE keeps its
existing variable-length guard in nvmet_auth_challenge().

This is reachable only when in-band DH-HMAC-CHAP authentication is
configured on the target.

## Affected

- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 80bf7b7f676e3987bbe06af3c359bd56ac91a5a9`
- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 2eaa3ad450141cfcf187bb43cb8335eb336b5f87`
- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < bc111698b46e43eddd8664cceaa621cd559e99a0`
- `Linux >= db1312dd95488b5e6ff362ff66fcf953a46b1821 < 779575bc35c687697ba69e904f2cd22e60112534`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.