Linux kernel nvmet-auth: uninitialized slab sent to a remote initiator during NVMe-oF authentication

Impact

nvmet_execute_auth_receive() sizes the response buffer with kmalloc() from the host-supplied AUTH_RECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size message into it. The whole allocation is then copied to the wire, so the initiator receives whatever was in the slab past the built message - up to nearly a page of uninitialized kernel memory per exchange. This happens during the pre-authentication handshake, so the peer does not need to hold valid credentials to collect it. Repeated connects give an attacker a sampling channel into target kernel slab contents, which is the kind of leak that turns a separate memory-corruption bug into a working exploit against the storage node your GPU fleet reads from.

Who can reach it

Any peer that can reach the NVMe-oF target portal and start a Fabrics connect with DH-HMAC-CHAP. The leak occurs before authentication completes, so no valid credentials are needed.

What to do

Apply the stable kernel fix on target nodes; it switches the allocation to kzalloc() so the unwritten tail is zeroed. Kernel change, so patched target nodes need a reboot unless livepatched. Conforming responses are unaffected, so there is no functional risk in taking it. In the meantime, limiting who can reach the target portal is the only mitigation - disabling in-band auth does not help, since the leak is in the auth path an initiator can invoke.

References

Related entries

• Linux kernel io_uring: folio shift overflow writes past the bvec array on 16G-hugepage kernelsCVE-2026-80810 · Linux kernel io_uring/rsrc (registered-buffer folio shift in io_vec_fill_bvec)Unscored
• Linux kernel io_uring uring_cmd: iovec leak under NVMe passthrough once the alloc cache fillsCVE-2026-80811 · Linux kernel io_uring uring_cmd (async command iovec lifetime)Unscored
• Linux kernel nvmet: NULL dereference when a host issues Identify CNS 07h against an NVMe-oF targetCVE-2026-80813 · Linux kernel nvmet (Identify CNS 07h active namespace list handler)Unscored
• Linux kernel iommufd: NULL dereference racing IOAS change_process against a file-backed mappingCVE-2026-80817 · Linux kernel iommufd (IOAS change_process racing iopt_map_file_pages)Unscored
• Linux kernel tegra241-cmdqv: use-after-free issuing CMD_SYNC on a freed command queue at teardownCVE-2026-80818 · Linux kernel iommu/tegra241-cmdqv (NVIDIA Grace SMMUv3 command-queue virtualization)Unscored
• Linux kernel virtio-crypto: unbounded device-reported result length over-reads guest kernel heapCVE-2026-80836 · Linux kernel virtio-crypto akcipher completion path (virtio_crypto_dataq_akcipher_callback)Unscored