CVE-2026-72130

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap out-of-bounds write can occur in the Linux kernel when in-band DH-HMAC-CHAP authentication is configured on the target. The function nvmet execute auth receive() trusts the AUTH RECEIVE allocation length without sufficient validation. In the SUCCESS1 and FAILURE1/default states, a remote NVMe-oF initiator can provide a kmalloc() buffer shorter than the required response, causing nvmet auth success1() and nvmet auth failure1() to write past the allocation. This allows an attacker to trigger a 16-byte heap out-of-bounds write using a one-byte AUTH RECEIVE allocation length.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.