CVE-2026-90230 (GCVE-0-2026-90230)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-18 17:53
VLAI
Title
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() nvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length (tl) and hands it to nvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate() then reads the negotiate header and, for each of the halen hash identifiers and dhlen DH group identifiers, indexes into the fixed idlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]). Neither the transfer length nor halen/dhlen is validated. A malicious or non-conformant host can report a tl smaller than the negotiate structure, or a halen/dhlen larger than the array (both are u8, up to 255), making the loops read past the end of the allocated buffer (heap out-of-bounds read). The sibling nvmet_auth_reply() already validates tl against the structure size; the negotiate path did not. Pass tl into nvmet_auth_negotiate(), reject a tl that does not cover the negotiate data plus one full protocol descriptor, and reject halen/dhlen larger than NVME_AUTH_DHCHAP_MAX_DH_IDS.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: db1312dd95488b5e6ff362ff66fcf953a46b1821 , < 89ff11b72f38976f3b5aea23a5228ee05e277209 (git)
Affected: db1312dd95488b5e6ff362ff66fcf953a46b1821 , < aaac783950b17c57df9b6f7344747cacb1a407ed (git)
Affected: db1312dd95488b5e6ff362ff66fcf953a46b1821 , < c38a8186326799957d293d370136c128cd113916 (git)
Affected: db1312dd95488b5e6ff362ff66fcf953a46b1821 , < 7b81e4d2230e3d2d372c826180c4ef0efc244f31 (git)
Affected: db1312dd95488b5e6ff362ff66fcf953a46b1821 , < 5bb96cc218835769ab74ec7f3ea2bf81fbffe955 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/fabrics-cmd-auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "89ff11b72f38976f3b5aea23a5228ee05e277209",
              "status": "affected",
              "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
              "versionType": "git"
            },
            {
              "lessThan": "aaac783950b17c57df9b6f7344747cacb1a407ed",
              "status": "affected",
              "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
              "versionType": "git"
            },
            {
              "lessThan": "c38a8186326799957d293d370136c128cd113916",
              "status": "affected",
              "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
              "versionType": "git"
            },
            {
              "lessThan": "7b81e4d2230e3d2d372c826180c4ef0efc244f31",
              "status": "affected",
              "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
              "versionType": "git"
            },
            {
              "lessThan": "5bb96cc218835769ab74ec7f3ea2bf81fbffe955",
              "status": "affected",
              "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/fabrics-cmd-auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()\n\nnvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with\nthe host-supplied transfer length (tl) and hands it to\nnvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate()\nthen reads the negotiate header and, for each of the halen hash\nidentifiers and dhlen DH group identifiers, indexes into the fixed\nidlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).\n\nNeither the transfer length nor halen/dhlen is validated. A malicious or\nnon-conformant host can report a tl smaller than the negotiate structure,\nor a halen/dhlen larger than the array (both are u8, up to 255), making\nthe loops read past the end of the allocated buffer (heap out-of-bounds\nread). The sibling nvmet_auth_reply() already validates tl against the\nstructure size; the negotiate path did not.\n\nPass tl into nvmet_auth_negotiate(), reject a tl that does not cover the\nnegotiate data plus one full protocol descriptor, and reject halen/dhlen\nlarger than NVME_AUTH_DHCHAP_MAX_DH_IDS."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The malformed bytes are the DH-HMAC-CHAP Negotiate payload of an NVMe-oF Authentication Send capsule (cmd-\u003eauth_send.tl). nvmet-tcp receives that capsule in nvmet_tcp_try_recv_pdu/nvmet_tcp_try_recv_data, nvmet_copy_from_sgl copies it, and nvmet_auth_negotiate() parses it; NVMe/TCP is IP-routable.\nAC:L - Unpatched nvmet_auth_negotiate() never checks tl, halen, or dhlen. A host that sets auth_send.tl below 72 bytes (negotiate header plus nvmf_auth_dhchap_protocol_descriptor) and/or sets the u8 halen/dhlen fields to 255 makes the idlist[i] and idlist[i+30] loops deterministically over-read kmalloc(tl) with no race.\nPR:N - nvmet_parse_admin_cmd routes fabrics opcodes to nvmet_parse_fabrics_admin_cmd before nvmet_check_ctrl_status(), so AUTH_SEND runs without nvmet_check_auth_status(). sq-\u003edhchap_step starts at NEGOTIATE, and nvmet_host_allowed() always permits nqn.2014-08.org.nvmexpress.discovery, so no DH-HMAC-CHAP secret is required.\nUI:N - The attacker opens a TCP connection to an already-listening nvmet-tcp port, sends Connect, then Authentication Send carrying the short or over-long DH-HMAC-CHAP Negotiate buffer; no victim mount, file open, or prompt is required.\nS:U - The over-read is of the kmalloc(tl) DH-HMAC-CHAP buffer and adjacent slab on the NVMe target host; it does not cross a VM, hypervisor, or IOMMU boundary.\nC:H - With tl shorter than the 72-byte negotiate-plus-descriptor layout, or with u8 halen/dhlen up to 255 against idlist[60], nvmet_auth_negotiate() heap-over-reads hundreds of bytes of adjacent slab via idlist[i] and idlist[i+30], which is not a few-byte leak.\nI:N - nvmet_auth_negotiate() only loads header fields and idlist[] entries and does not write past the allocation. Assigning ctrl-\u003eshash_id or ctrl-\u003edh_gid from a parsed identifier is an in-bounds field update, not an OOB write or hijack primitive.\nA:H - Walking idlist[] hundreds of bytes past a small kmalloc(tl) AUTH_SEND object can oops if the read hits an unmapped page or a KASAN/KFENCE redzone, and the initiator can repeat Authentication Send on new connections to the same target."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:57.758Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/89ff11b72f38976f3b5aea23a5228ee05e277209"
        },
        {
          "url": "https://git.kernel.org/stable/c/aaac783950b17c57df9b6f7344747cacb1a407ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/c38a8186326799957d293d370136c128cd113916"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b81e4d2230e3d2d372c826180c4ef0efc244f31"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bb96cc218835769ab74ec7f3ea2bf81fbffe955"
        }
      ],
      "title": "nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90230",
    "datePublished": "2026-09-17T16:07:37.940Z",
    "dateReserved": "2026-09-11T19:38:34.794Z",
    "dateUpdated": "2026-09-18T17:53:57.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90230",
      "date": "2026-09-25",
      "epss": "0.00653",
      "percentile": "0.49152"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:45:32.000Z",
      "cve": "CVE-2026-90230",
      "id": "msrc_CVE-2026-90230",
      "initial_release_date": "2026-09-19T01:15:53.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90230.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/fabrics-cmd-auth.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "89ff11b72f38976f3b5aea23a5228ee05e277209",
                    "status": "affected",
                    "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "aaac783950b17c57df9b6f7344747cacb1a407ed",
                    "status": "affected",
                    "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c38a8186326799957d293d370136c128cd113916",
                    "status": "affected",
                    "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7b81e4d2230e3d2d372c826180c4ef0efc244f31",
                    "status": "affected",
                    "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5bb96cc218835769ab74ec7f3ea2bf81fbffe955",
                    "status": "affected",
                    "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/fabrics-cmd-auth.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.0"
                  },
                  {
                    "lessThan": "6.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()\n\nnvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with\nthe host-supplied transfer length (tl) and hands it to\nnvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate()\nthen reads the negotiate header and, for each of the halen hash\nidentifiers and dhlen DH group identifiers, indexes into the fixed\nidlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).\n\nNeither the transfer length nor halen/dhlen is validated. A malicious or\nnon-conformant host can report a tl smaller than the negotiate structure,\nor a halen/dhlen larger than the array (both are u8, up to 255), making\nthe loops read past the end of the allocated buffer (heap out-of-bounds\nread). The sibling nvmet_auth_reply() already validates tl against the\nstructure size; the negotiate path did not.\n\nPass tl into nvmet_auth_negotiate(), reject a tl that does not cover the\nnegotiate data plus one full protocol descriptor, and reject halen/dhlen\nlarger than NVME_AUTH_DHCHAP_MAX_DH_IDS."
          }
        ],
        "id": "CVE-2026-90230",
        "lastModified": "2026-09-18T18:17:47.987",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:18.803",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5bb96cc218835769ab74ec7f3ea2bf81fbffe955"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7b81e4d2230e3d2d372c826180c4ef0efc244f31"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/89ff11b72f38976f3b5aea23a5228ee05e277209"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/aaac783950b17c57df9b6f7344747cacb1a407ed"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c38a8186326799957d293d370136c128cd113916"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.