CVE-2026-98725
Received Received - Intake

Buffer Overflow in Linux Kernel NVMe Target Authentication

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the check before the challenge is copied past the end of its allocation. Use the typed challenge pointer when calculating the response size. BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) Write of size 32 by task kworker/1:1H/64 Workqueue: nvmet_tcp_wq nvmet_tcp_io_work Call Trace: nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243) nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) The buggy address is located 16 bytes inside of allocated 33-byte region [ffff888000554e80, ffff888000554ea1) Kernel panic - not syncing: KASAN: panic_on_warn set ...

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98725
EUVD
EUVD-2026-103810

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux db1312dd95488b5e6ff362ff66fcf953a46b1821
Linux Linux db1312dd95488b5e6ff362ff66fcf953a46b1821
Linux Linux db1312dd95488b5e6ff362ff66fcf953a46b1821
Linux Linux db1312dd95488b5e6ff362ff66fcf953a46b1821
Linux Linux 6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a function called nvmet_auth_challenge() incorrectly calculates the size of a buffer due to a type mismatch. The function uses a void pointer to receive an output buffer, causing sizeof(*d) to evaluate to 1 byte instead of the correct size. This leads to an out-of-bounds write when copying challenge data, potentially corrupting memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe over Fabrics (NVMe-oF) target implementation. Detection requires checking kernel logs for KASAN errors related to slab-out-of-bounds writes in nvmet_auth_challenge(). Look for kernel panic messages or KASAN reports mentioning drivers/nvme/target/fabrics-cmd-auth.c or nvmet_execute_auth_receive.

Impact Analysis

This vulnerability could allow an attacker to cause a kernel panic or execute arbitrary code with kernel privileges by sending a maliciously crafted AUTH_RECEIVE buffer. This may lead to system crashes, data corruption, or unauthorized access to sensitive information on affected systems.

Mitigation Strategies

Apply the Linux kernel patch that fixes the out-of-bounds write in nvmet_auth_challenge(). Update to a kernel version containing the fix. If immediate patching is not possible, disable NVMe-oF authentication features or restrict network access to NVMe-oF targets until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98725. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart