SB20260816396 - Heap-based buffer overflow in Linux kernel nvme target driver

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-72130)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in nvmet_execute_auth_receive() and the DH-HMAC-CHAP response builders when processing AUTH_RECEIVE commands with a too-short allocation length. A remote user can send a specially crafted AUTH_RECEIVE command to cause a denial of service.

This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2eaa3ad450141cfcf187bb43cb8335eb336b5f87
• https://git.kernel.org/stable/c/779575bc35c687697ba69e904f2cd22e60112534
• https://git.kernel.org/stable/c/80bf7b7f676e3987bbe06af3c359bd56ac91a5a9
• https://git.kernel.org/stable/c/bc111698b46e43eddd8664cceaa621cd559e99a0