CVE-2026-80791
Received Received - Intake

nvmet-auth Zeroed Response Buffer in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTH_RECEIVE response buffer nvmet_execute_auth_receive() allocates the response buffer with kmalloc() sized by the host-supplied AUTH_RECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size message into it. The full allocation length is then copied to the wire by nvmet_copy_to_sgl(), so a remote initiator receives the bytes past the built message -- up to nearly a page of uninitialized slab -- during the pre-authentication handshake. Allocate the buffer with kzalloc() so the unwritten tail is zeroed before it is sent; conforming responses are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80791
EUVD
EUVD-2026-71434

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory handling issue in the NVMe over Fabrics (NVMe-oF) target subsystem. When processing authentication requests, the system allocates a response buffer based on the size requested by the host. However, the authentication code only writes a fixed-size message into this buffer, leaving the remaining space uninitialized. When the response is sent back to the initiator, this uninitialized memory (up to a page in size) is exposed, potentially leaking sensitive data from the kernel's memory.

Impact Analysis

If you use systems running vulnerable Linux kernels with NVMe-oF target support, an attacker on the same network could exploit this flaw during the authentication handshake to read uninitialized kernel memory. This may expose sensitive information such as cryptographic keys, passwords, or other secrets processed by the kernel.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve the nvmet-auth vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80791. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart