CVE-2026-80791

What it actually does

The nvmet_execute_auth_receive handler allocates a response buffer sized by an untrusted host-supplied length using kmalloc, writes only a fixed-size DH-HMAC-CHAP structure into it, and then transmits the entire allocation (including uninitialized slab bytes) over the wire during the pre-authentication phase.

Why it matters to the business

Remote initiators can obtain up to a page of kernel memory contents before any authentication occurs; the flaw has been public for 25 days with minimal observed exploitation risk and no known ransomware use, limiting immediate operational disruption but still requiring prompt kernel updates across NVMe-oF target deployments.

How an attack unfolds

An attacker acting as an NVMe-oF initiator issues an AUTH_RECEIVE command with a large allocation length during the initial handshake; the target kernel returns the partially filled buffer, exposing residual slab data that may contain credentials, pointers, or other kernel structures.

How to fix it

Upgrade the Linux kernel to a version containing the kzalloc fix for nvmet-auth; rebuild and redeploy any custom kernels or distributions that include the nvmet module; apply vendor-supplied updates as they become available.

How to confirm the fix worked

Confirm the presence of kzalloc in nvmet_execute_auth_receive in the running kernel source or binary; verify that AUTH_RECEIVE responses no longer contain non-zero bytes beyond the expected message length in test environments.

Typical attack path

1. Establish an unauthenticated NVMe-oF connection to the target
2. Send AUTH_RECEIVE with an allocation length larger than the fixed message size
3. Receive and parse the response buffer to extract uninitialized memory contents
4. Repeat or vary lengths to increase the volume of leaked data

How to detect it

Inspect NVMe-oF target logs or packet captures for AUTH_RECEIVE commands carrying unusually large allocation lengths; examine response payloads for non-zero data beyond the expected DH-HMAC-CHAP structure size.

What your security team should do

• Prioritize kernel updates on all NVMe-oF target systems within standard change windows
• Monitor upstream stable branches and distribution advisories for the specific commit
• Restrict unauthenticated NVMe-oF access from untrusted initiators until patches are applied
• Review and reduce the attack surface of exposed NVMe-oF ports where feasible