SB20261022331 - Out-of-bounds write in Linux kernel nvme target driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-98725)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to an out-of-bounds write in the Linux kernel's nvmet_auth_challenge() function when handling an AUTH_RECEIVE request with a short output buffer. A remote attacker can submit a request with an insufficient response buffer length to bypass a size check that undercounts the fixed challenge header by 15 bytes, causing the challenge to be written beyond the allocated buffer and potentially crashing the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4
• https://git.kernel.org/stable/c/8a9b4c0eef19c207663c1ee888257307c869ca86
• https://git.kernel.org/stable/c/9d61131acd742cf97ee64e453383e41b46568513
• https://git.kernel.org/stable/c/ef4dfad231a787aded76e5b03788ddb18c8aebab
• https://git.kernel.org/stable/c/fa6778e030bed9841ddcdf96bc7018da9ac03562