CVE-2026-80791

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: zero the AUTH_RECEIVE response buffer

nvmet_execute_auth_receive() allocates the response buffer with kmalloc()

sized by the host-supplied AUTH_RECEIVE allocation length, but the

DH-HMAC-CHAP builders write only a fixed-size message into it. The full

allocation length is then copied to the wire by nvmet_copy_to_sgl(), so a

remote initiator receives the bytes past the built message -- up to nearly

a page of uninitialized slab -- during the pre-authentication handshake.

Allocate the buffer with kzalloc() so the unwritten tail is zeroed before

it is sent; conforming responses are unaffected.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References