Look up another CVE · open CVE-2026-90230 in the interactive tracker
CVE-2026-90230
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem drivers/nvme. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90230 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
nvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length (tl) and hands it to nvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate() then reads the negotiate header and, for each of the halen hash identifiers and dhlen DH group identifiers, indexes into the fixed idlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]). Neither the transfer length nor halen/dhlen is validated. A malicious or non-conformant host can report a tl smaller than the negotiate structure, or a halen/dhlen larger than the array (both are u8, up to 255), making the loops read past the end of the allocated buffer (heap out-of-bounds read). The sibling nvmet_auth_reply() already validates tl against the structure size; the negotiate path did not. Pass tl into nvmet_auth_negotiate(), reject a tl that does not cover the negotiate data plus one full protocol descriptor, and reject halen/dhlen larger than NVME_AUTH_DHCHAP_MAX_DH_IDS.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/nvme/target/fabrics-cmd-auth.c
- What this is
- NVM EXPRESS FABRICS AUTHENTICATIONMAINTAINERS section matched on drivers/nvme/target/fabrics-cmd-auth.c · linux-nvme@lists.infradead.org · Supported
- Kernel module
- nvmet
Check it on the machine
grep -wE 'CONFIG_NVME_TARGET|CONFIG_NVME_TARGET_AUTH' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nvmetPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 1 release. It does build it in 4 releases, so the answer depends on which release the machine runs.
- bookwormn
- trixie, forky, sid, bookworm · linux-6.12m
- n
- not enabled on any flavour - this release does not build the code
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_NVME_TARGET, CONFIG_NVME_TARGET_AUTH
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 9.1 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.46%, higher than 38.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/nvme
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.0 | 6.6.157 | 89ff11b72f38 |
| 6.0 | 6.12.110 | aaac783950b1 |
| 6.0 | 6.18.52 | c38a81863267 |
| 6.0 | 7.2.6 | 7b81e4d2230e |
| 6.0 | 7.3 | 5bb96cc21883 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The malformed bytes are the DH-HMAC-CHAP Negotiate payload of an NVMe-oF Authentication Send capsule (cmd->auth_send.tl). nvmet-tcp receives that capsule in nvmet_tcp_try_recv_pdu/nvmet_tcp_try_recv_data, nvmet_copy_from_sgl copies it, and nvmet_auth_negotiate() parses it; NVMe/TCP is IP-routable.
- AC:LAttack complexity, low
- Unpatched nvmet_auth_negotiate() never checks tl, halen, or dhlen. A host that sets auth_send.tl below 72 bytes (negotiate header plus nvmf_auth_dhchap_protocol_descriptor) and/or sets the u8 halen/dhlen fields to 255 makes the idlist[i] and idlist[i+30] loops deterministically over-read kmalloc(tl) with no race.
- PR:NPrivileges required, none
- nvmet_parse_admin_cmd routes fabrics opcodes to nvmet_parse_fabrics_admin_cmd before nvmet_check_ctrl_status(), so AUTH_SEND runs without nvmet_check_auth_status(). sq->dhchap_step starts at NEGOTIATE, and nvmet_host_allowed() always permits nqn.2014-08.org.nvmexpress.discovery, so no DH-HMAC-CHAP secret is required.
- UI:NUser interaction, none
- The attacker opens a TCP connection to an already-listening nvmet-tcp port, sends Connect, then Authentication Send carrying the short or over-long DH-HMAC-CHAP Negotiate buffer; no victim mount, file open, or prompt is required.
- S:UScope, unchanged
- The over-read is of the kmalloc(tl) DH-HMAC-CHAP buffer and adjacent slab on the NVMe target host; it does not cross a VM, hypervisor, or IOMMU boundary.
- C:HConfidentiality impact, high
- With tl shorter than the 72-byte negotiate-plus-descriptor layout, or with u8 halen/dhlen up to 255 against idlist[60], nvmet_auth_negotiate() heap-over-reads hundreds of bytes of adjacent slab via idlist[i] and idlist[i+30], which is not a few-byte leak.
- I:NIntegrity impact, none
- nvmet_auth_negotiate() only loads header fields and idlist[] entries and does not write past the allocation. Assigning ctrl->shash_id or ctrl->dh_gid from a parsed identifier is an in-bounds field update, not an OOB write or hijack primitive.
- A:HAvailability impact, high
- Walking idlist[] hundreds of bytes past a small kmalloc(tl) AUTH_SEND object can oops if the read hits an unmapped page or a KASAN/KFENCE redzone, and the initiator can repeat Authentication Send on new connections to the same target.