CVE-2026-72130
Received Received - Intake

Heap Out-of-Bounds Write in Linux Kernel NVMe-oF Target

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF initiator reach the fixed-size DH-HMAC-CHAP response builders with a kmalloc() buffer shorter than the response, so nvmet_auth_success1() and nvmet_auth_failure1() write past the allocation; both only WARN_ON the short length and then format the message anyway. Impact: A remote NVMe-oF initiator with access to an auth-enabled target can trigger a 16-byte heap out-of-bounds write via a one-byte AUTH_RECEIVE allocation length. Compute the minimum response length for the current DH-HMAC-CHAP step in nvmet_auth_receive_data_len() and report a zero data length when the host-supplied allocation length is shorter, so the existing zero-length check in nvmet_execute_auth_receive() rejects the command before any builder runs. The SUCCESS1 minimum is sizeof(struct nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the response hash is written into the rval[] flexible-array tail, so the minimum is state dependent rather than a flat sizeof. CHALLENGE keeps its existing variable-length guard in nvmet_auth_challenge(). This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72130
EUVD
EUVD-2026-58888

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of AUTH_RECEIVE buffers in the NVMe over Fabrics (NVMe-oF) authentication process. A remote attacker with access to an authenticated target can send a maliciously crafted AUTH_RECEIVE command with a short buffer length, causing the system to write past the allocated memory. This results in a 16-byte heap out-of-bounds write during DH-HMAC-CHAP authentication steps.

Detection Guidance

This vulnerability is specific to Linux kernel NVMe-oF targets with in-band DH-HMAC-CHAP authentication enabled. Detection requires checking kernel logs for heap out-of-bounds write warnings related to nvmet_auth_success1 or nvmet_auth_failure1 functions. Monitor for crashes or memory corruption in NVMe-oF target processes.

Impact Analysis

If you are using a Linux system with NVMe-oF and in-band DH-HMAC-CHAP authentication enabled, an attacker on the same network could exploit this flaw to corrupt kernel memory. This may lead to system crashes, data corruption, or potentially allow the attacker to execute arbitrary code with kernel privileges, depending on the system configuration and defenses.

Compliance Impact

This vulnerability could impact compliance by compromising the integrity and confidentiality of data processed by systems using NVMe-oF with authentication. For GDPR, it may lead to unauthorized access to personal data. For HIPAA, it could expose protected health information. Organizations must ensure systems are patched to maintain compliance with these regulations.

Mitigation Strategies

Disable in-band DH-HMAC-CHAP authentication on NVMe-oF targets if not required. Update the Linux kernel to the patched version. Restrict network access to NVMe-oF targets to trusted initiators only. Monitor for unusual memory corruption or crashes in NVMe-oF services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72130. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart