CVE-2026-90230 (GCVE-0-2026-90230)
Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-10-19 09:00
VLAI
EPSS
VEX
Title
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
nvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with
the host-supplied transfer length (tl) and hands it to
nvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate()
then reads the negotiate header and, for each of the halen hash
identifiers and dhlen DH group identifiers, indexes into the fixed
idlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).
Neither the transfer length nor halen/dhlen is validated. A malicious or
non-conformant host can report a tl smaller than the negotiate structure,
or a halen/dhlen larger than the array (both are u8, up to 255), making
the loops read past the end of the allocated buffer (heap out-of-bounds
read). The sibling nvmet_auth_reply() already validates tl against the
structure size; the negotiate path did not.
Pass tl into nvmet_auth_negotiate(), reject a tl that does not cover the
negotiate data plus one full protocol descriptor, and reject halen/dhlen
larger than NVME_AUTH_DHCHAP_MAX_DH_IDS.
Severity
9.1 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
db1312dd95488b5e6ff362ff66fcf953a46b1821 , < 89ff11b72f38976f3b5aea23a5228ee05e277209
(git)
Affected: db1312dd95488b5e6ff362ff66fcf953a46b1821 , < aaac783950b17c57df9b6f7344747cacb1a407ed (git) Affected: db1312dd95488b5e6ff362ff66fcf953a46b1821 , < c38a8186326799957d293d370136c128cd113916 (git) Affected: db1312dd95488b5e6ff362ff66fcf953a46b1821 , < 7b81e4d2230e3d2d372c826180c4ef0efc244f31 (git) Affected: db1312dd95488b5e6ff362ff66fcf953a46b1821 , < 5bb96cc218835769ab74ec7f3ea2bf81fbffe955 (git) |
guessed | |
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fabrics-cmd-auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89ff11b72f38976f3b5aea23a5228ee05e277209",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "aaac783950b17c57df9b6f7344747cacb1a407ed",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "c38a8186326799957d293d370136c128cd113916",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "7b81e4d2230e3d2d372c826180c4ef0efc244f31",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "5bb96cc218835769ab74ec7f3ea2bf81fbffe955",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fabrics-cmd-auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()\n\nnvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with\nthe host-supplied transfer length (tl) and hands it to\nnvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate()\nthen reads the negotiate header and, for each of the halen hash\nidentifiers and dhlen DH group identifiers, indexes into the fixed\nidlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).\n\nNeither the transfer length nor halen/dhlen is validated. A malicious or\nnon-conformant host can report a tl smaller than the negotiate structure,\nor a halen/dhlen larger than the array (both are u8, up to 255), making\nthe loops read past the end of the allocated buffer (heap out-of-bounds\nread). The sibling nvmet_auth_reply() already validates tl against the\nstructure size; the negotiate path did not.\n\nPass tl into nvmet_auth_negotiate(), reject a tl that does not cover the\nnegotiate data plus one full protocol descriptor, and reject halen/dhlen\nlarger than NVME_AUTH_DHCHAP_MAX_DH_IDS."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The malformed bytes are the DH-HMAC-CHAP Negotiate payload of an NVMe-oF Authentication Send capsule (cmd-\u003eauth_send.tl). nvmet-tcp receives that capsule in nvmet_tcp_try_recv_pdu/nvmet_tcp_try_recv_data, nvmet_copy_from_sgl copies it, and nvmet_auth_negotiate() parses it; NVMe/TCP is IP-routable.\nAC:L - Unpatched nvmet_auth_negotiate() never checks tl, halen, or dhlen. A host that sets auth_send.tl below 72 bytes (negotiate header plus nvmf_auth_dhchap_protocol_descriptor) and/or sets the u8 halen/dhlen fields to 255 makes the idlist[i] and idlist[i+30] loops deterministically over-read kmalloc(tl) with no race.\nPR:N - nvmet_parse_admin_cmd routes fabrics opcodes to nvmet_parse_fabrics_admin_cmd before nvmet_check_ctrl_status(), so AUTH_SEND runs without nvmet_check_auth_status(). sq-\u003edhchap_step starts at NEGOTIATE, and nvmet_host_allowed() always permits nqn.2014-08.org.nvmexpress.discovery, so no DH-HMAC-CHAP secret is required.\nUI:N - The attacker opens a TCP connection to an already-listening nvmet-tcp port, sends Connect, then Authentication Send carrying the short or over-long DH-HMAC-CHAP Negotiate buffer; no victim mount, file open, or prompt is required.\nS:U - The over-read is of the kmalloc(tl) DH-HMAC-CHAP buffer and adjacent slab on the NVMe target host; it does not cross a VM, hypervisor, or IOMMU boundary.\nC:H - With tl shorter than the 72-byte negotiate-plus-descriptor layout, or with u8 halen/dhlen up to 255 against idlist[60], nvmet_auth_negotiate() heap-over-reads hundreds of bytes of adjacent slab via idlist[i] and idlist[i+30], which is not a few-byte leak.\nI:N - nvmet_auth_negotiate() only loads header fields and idlist[] entries and does not write past the allocation. Assigning ctrl-\u003eshash_id or ctrl-\u003edh_gid from a parsed identifier is an in-bounds field update, not an OOB write or hijack primitive.\nA:H - Walking idlist[] hundreds of bytes past a small kmalloc(tl) AUTH_SEND object can oops if the read hits an unmapped page or a KASAN/KFENCE redzone, and the initiator can repeat Authentication Send on new connections to the same target."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:00:06.762Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89ff11b72f38976f3b5aea23a5228ee05e277209"
},
{
"url": "https://git.kernel.org/stable/c/aaac783950b17c57df9b6f7344747cacb1a407ed"
},
{
"url": "https://git.kernel.org/stable/c/c38a8186326799957d293d370136c128cd113916"
},
{
"url": "https://git.kernel.org/stable/c/7b81e4d2230e3d2d372c826180c4ef0efc244f31"
},
{
"url": "https://git.kernel.org/stable/c/5bb96cc218835769ab74ec7f3ea2bf81fbffe955"
}
],
"title": "nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90230",
"datePublished": "2026-09-17T16:07:37.940Z",
"dateReserved": "2026-09-11T19:38:34.794Z",
"dateUpdated": "2026-10-19T09:00:06.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-90230",
"date": "2026-11-13",
"epss": "0.00457",
"percentile": "0.40174"
},
"microsoft_vex": {
"current_release_date": "2026-10-21T18:36:53.000Z",
"cve": "CVE-2026-90230",
"id": "msrc_CVE-2026-90230",
"initial_release_date": "2026-09-19T01:15:53.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "2",
"product_status:under_investigation": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90230.json",
"version": "6"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fabrics-cmd-auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89ff11b72f38976f3b5aea23a5228ee05e277209",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "aaac783950b17c57df9b6f7344747cacb1a407ed",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "c38a8186326799957d293d370136c128cd113916",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "7b81e4d2230e3d2d372c826180c4ef0efc244f31",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "5bb96cc218835769ab74ec7f3ea2bf81fbffe955",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fabrics-cmd-auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()\n\nnvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with\nthe host-supplied transfer length (tl) and hands it to\nnvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate()\nthen reads the negotiate header and, for each of the halen hash\nidentifiers and dhlen DH group identifiers, indexes into the fixed\nidlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).\n\nNeither the transfer length nor halen/dhlen is validated. A malicious or\nnon-conformant host can report a tl smaller than the negotiate structure,\nor a halen/dhlen larger than the array (both are u8, up to 255), making\nthe loops read past the end of the allocated buffer (heap out-of-bounds\nread). The sibling nvmet_auth_reply() already validates tl against the\nstructure size; the negotiate path did not.\n\nPass tl into nvmet_auth_negotiate(), reject a tl that does not cover the\nnegotiate data plus one full protocol descriptor, and reject halen/dhlen\nlarger than NVME_AUTH_DHCHAP_MAX_DH_IDS."
}
],
"id": "CVE-2026-90230",
"lastModified": "2026-10-19T09:19:13.423",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-09-17T17:17:18.803",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/5bb96cc218835769ab74ec7f3ea2bf81fbffe955"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/7b81e4d2230e3d2d372c826180c4ef0efc244f31"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/89ff11b72f38976f3b5aea23a5228ee05e277209"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/aaac783950b17c57df9b6f7344747cacb1a407ed"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/c38a8186326799957d293d370136c128cd113916"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-06T01:33:51+00:00",
"cve": "CVE-2026-90230",
"id": "CVE-2026-90230",
"initial_release_date": "2026-09-17T00:00:00+00:00",
"product_status:known_affected": "112",
"product_status:known_not_affected": "91",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90230.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.