Cloudanix VulnDB

CVE-2026-98725

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's handling of certain storage authentication messages can let an attacker crash the system or corrupt memory.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Remote Code Execution
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in nvmet_auth_challenge() caused by using sizeof on a void pointer instead of the typed challenge structure, allowing a short AUTH_RECEIVE buffer to copy 15 extra bytes past the end of a slab allocation in the NVMe target fabrics auth path.

Why it matters to the business

Linux systems exposing NVMe over Fabrics targets with authentication enabled can experience kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation; recent publication and absence of known exploits keep immediate risk low but require prompt patching on storage servers.

How an attack unfolds

An attacker connected to an NVMe target sends a crafted, undersized AUTH_RECEIVE PDU that passes the length check; the kernel then copies the challenge header plus data using an under-sized size calculation, writing past the allocated slab and triggering KASAN or a panic during nvmet_tcp_io_work processing.

How to fix it

Apply the upstream fix that replaces the sizeof calculation with the typed challenge pointer; rebuild and deploy updated Linux kernel packages containing the corrected nvmet-auth code on all affected NVMe target systems.

How to confirm the fix worked

Confirm the kernel source contains the change that computes response size from the typed nvmet_auth_challenge structure; recompile, boot the new kernel, and verify absence of the KASAN report on crafted AUTH_RECEIVE input.

Typical attack path

  1. Establish NVMe-oF TCP connection to target
  2. Initiate authentication exchange
  3. Send short AUTH_RECEIVE command with crafted header
  4. Trigger nvmet_execute_auth_receive path
  5. Cause slab-out-of-bounds write and kernel fault

How to detect it

Search kernel logs and audit trails for KASAN slab-out-of-bounds warnings referencing nvmet_execute_auth_receive or nvmet_tcp_io_work; inspect workqueue activity involving nvmet_tcp_wq and any preceding AUTH_RECEIVE PDUs.

What your security team should do

  • Prioritize kernel updates on all NVMe-oF target hosts within the next maintenance window
  • Disable NVMe authentication on targets if not required until patched
  • Monitor kernel logs for KASAN slab-out-of-bounds reports in nvmet_execute_auth_receive
  • Track EPSS and exploit maturity updates for this issue

The record

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the check before the challenge is copied past the end of its allocation. Use the typed challenge pointer when calculating the response size. BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) Write of size 32 by task kworker/1:1H/64 Workqueue: nvmet_tcp_wq nvmet_tcp_io_work Call Trace: nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243) nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) The buggy address is located 16 bytes inside of allocated 33-byte region [ffff888000554e80, ffff888000554ea1) Kernel panic - not syncing: KASAN: panic_on_warn set ...

Affected packages

Ecosystem Package Introduced Fixed