Heap-based buffer overflow in Linux kernel - CVE-2026-72130

Vulnerability identifier: #VU143460

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-72130

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in nvmet_execute_auth_receive() and the DH-HMAC-CHAP response builders when processing AUTH_RECEIVE commands with a too-short allocation length. A remote user can send a specially crafted AUTH_RECEIVE command to cause a denial of service.

This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.

Linux kernel
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Ubuntu
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
kernel-rt (Red Hat package)
kernel (Red Hat package)
linux-nvidia-tegra (Ubuntu package)
linux (Ubuntu package)
linux-gke (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-azure (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-rt (Red Hat package) - update to 5.14.0-284.197.1.rt14.482.el9_2
kernel (Red Hat package) - addressed in versions 5.14.0-427.154.1.el9_4, 6.12.0-55.108.1.el10_0, 6.12.0-211.50.1.el10_2
linux-nvidia-tegra (Ubuntu package) - update to 6.8.0-1035.38
linux (Ubuntu package) - addressed in versions 7.0.0-34.34~24.04.1, 7.0.0-34.34, 7.0.0-34.34.1, 7.0.0-1012.12~24.04.1, 7.0.0-1013.13~24.04.1, 7.0.0-1013.13, 7.0.0-1014.14, 7.0.0-1020.20
linux-gke (Ubuntu package) - update to 7.0.0-1007.8
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1012.12~24.04.1
linux-gcp (Ubuntu package) - addressed in versions 7.0.0-1013.13~24.04.1, 7.0.0-1013.13, 7.0.0-1014.14
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1017.17

• https://git.kernel.org/stable/c/2eaa3ad450141cfcf187bb43cb8335eb336b5f87
• https://git.kernel.org/stable/c/779575bc35c687697ba69e904f2cd22e60112534
• https://git.kernel.org/stable/c/80bf7b7f676e3987bbe06af3c359bd56ac91a5a9
• https://git.kernel.org/stable/c/bc111698b46e43eddd8664cceaa621cd559e99a0

• Heap-based buffer overflow in Linux kernel nvme target driver
• Red Hat Enterprise Linux 10 update for kernel
• Ubuntu update for linux-gcp
• Ubuntu update for linux
• Ubuntu update for linux-oracle-7.0
• Ubuntu update for linux-nvidia-tegra
• Ubuntu update for linux-gke
• Red Hat Enterprise Linux 10 update for kernel
• Red Hat Enterprise Linux 9 update for kernel
• Ubuntu update for linux-azure-7.0
• Ubuntu update for linux-azure
• Red Hat Enterprise Linux 9 update for kernel-rt