CVE-2026-90230

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

nvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with

the host-supplied transfer length (tl) and hands it to

nvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate()

then reads the negotiate header and, for each of the halen hash

identifiers and dhlen DH group identifiers, indexes into the fixed

idlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).

Neither the transfer length nor halen/dhlen is validated. A malicious or

non-conformant host can report a tl smaller than the negotiate structure,

or a halen/dhlen larger than the array (both are u8, up to 255), making

the loops read past the end of the allocated buffer (heap out-of-bounds

read). The sibling nvmet_auth_reply() already validates tl against the

structure size; the negotiate path did not.

Pass tl into nvmet_auth_negotiate(), reject a tl that does

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References