Database/Kernel, userspace & hypervisor
Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: The sibling of the
Impact
The sibling of the previous finding and worse - this one writes. nvmet_execute_auth_receive() trusted the AUTH_RECEIVE allocation length after checking only that it was non-zero, so a remote initiator supplying a one-byte allocation length reaches the fixed-size response builders with an undersized buffer and triggers a 16-byte heap out-of-bounds write. The code merely warned about the short length and then formatted the response anyway. A controlled heap write from a remote peer on a storage node is a direct path to kernel code execution and thus to every tenant volume the target serves.
Who can reach it
A remote NVMe-oF initiator with access to an auth-enabled target sends an AUTH_RECEIVE with a one-byte allocation length while the exchange is in the SUCCESS1 or FAILURE1 state. Reachable only when in-band DH-HMAC-CHAP is configured - so again, this is a risk you take on by following the standard hardening advice on an unpatched kernel.
What to do
Host reboot / kernel upgrade on NVMe-oF targets. Patch before enabling DH-HMAC-CHAP; if auth is already on and the kernel is unpatched, treat the upgrade as urgent and restrict target reachability to known initiators at the firewall in the meantime. Roll targets in waves with multipath initiators so tenants see no I/O interruption.
References
Related entries
- Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
- Linux kernel (net/xfrm): NAT-keepalive frees the keepalive skb whenever the IPv4/IPv6 send helper returns an errorCVE-2026-72137 · Linux kernel (net/xfrm)Critical
- Linux kernel (net/xfrm): The IPsec input path validates a security association before taking the state lock, so a stateCVE-2026-72451 · Linux kernel (net/xfrm)Critical
- Linux kernel (net/xfrm): Async ESP resumption holds a reference on the original skbCVE-2026-72463 · Linux kernel (net/xfrm)Critical
- Linux kernel SoftiWARP connection manager (siw_cm, endpoint/socket disassociation): A malformed MPA request duringCVE-2026-74345 · Linux kernel SoftiWARP connection manager (siw_cm, endpoint/socket disassociation)Critical
- Linux kernel (drivers/nvme/host): An off-by-one in the Flexible Data Placement index check accepts a placement indexCVE-2026-74361 · Linux kernel (drivers/nvme/host)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.