CVE-2026-80791

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: zero the AUTH RECEIVE response buffer

nvmet execute auth receive() allocates the response buffer with kmalloc() sized by the host-supplied AUTH RECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size message into it. The full allocation length is then copied to the wire by nvmet copy to sgl(), so a remote initiator receives the bytes past the built message -- up to nearly a page of uninitialized slab -- during the pre-authentication handshake.

Allocate the buffer with kzalloc() so the unwritten tail is zeroed before it is sent; conforming responses are unaffected.