CVE-2026-98725

Received Received - Intake

Buffer Overflow in Linux Kernel NVMe Target Authentication

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the check before the challenge is copied past the end of its allocation. Use the typed challenge pointer when calculating the response size. BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) Write of size 32 by task kworker/1:1H/64 Workqueue: nvmet_tcp_wq nvmet_tcp_io_work Call Trace: nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243) nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) The buggy address is located 16 bytes inside of allocated 33-byte region [ffff888000554e80, ffff888000554ea1) Kernel panic - not syncing: KASAN: panic_on_warn set ...

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98725

EUVD

EUVD-2026-103810

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	db1312dd95488b5e6ff362ff66fcf953a46b1821
Linux	Linux	db1312dd95488b5e6ff362ff66fcf953a46b1821
Linux	Linux	db1312dd95488b5e6ff362ff66fcf953a46b1821
Linux	Linux	db1312dd95488b5e6ff362ff66fcf953a46b1821
Linux	Linux	6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a function called nvmet_auth_challenge() incorrectly calculates the size of a buffer due to a type mismatch. The function uses a void pointer to receive an output buffer, causing sizeof(*d) to evaluate to 1 byte instead of the correct size. This leads to an out-of-bounds write when copying challenge data, potentially corrupting memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe over Fabrics (NVMe-oF) target implementation. Detection requires checking kernel logs for KASAN errors related to slab-out-of-bounds writes in nvmet_auth_challenge(). Look for kernel panic messages or KASAN reports mentioning drivers/nvme/target/fabrics-cmd-auth.c or nvmet_execute_auth_receive.

Impact Analysis

This vulnerability could allow an attacker to cause a kernel panic or execute arbitrary code with kernel privileges by sending a maliciously crafted AUTH_RECEIVE buffer. This may lead to system crashes, data corruption, or unauthorized access to sensitive information on affected systems.

Compliance Impact

This vulnerability involves an out-of-bounds write in the Linux kernel's NVMe target authentication mechanism, which could lead to memory corruption and potential system instability. While the specific impact on compliance standards like GDPR or HIPAA is not detailed in the provided context, such vulnerabilities may affect data integrity and security controls required by these regulations.

Mitigation Strategies

Apply the Linux kernel patch that fixes the out-of-bounds write in nvmet_auth_challenge(). Update to a kernel version containing the fix. If immediate patching is not possible, disable NVMe-oF authentication features or restrict network access to NVMe-oF targets until patched.

Hi! I’m here to help you understand CVE-2026-98725. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70