CVE-2026-90230

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap out-of-bounds read exists in the nvmet auth negotiate() function. The nvmet execute auth send() function allocates a DH-HMAC-CHAP message buffer using a host-supplied transfer length tl but fails to pass this length to nvmet auth negotiate(). Because the transfer length and the halen (hash identifiers) and dhlen (DH group identifiers) variables are not validated, a malicious host can provide a tl smaller than the negotiate structure or a halen/dhlen larger than the fixed idlist[60] array. This allows the system to read data past the end of the allocated buffer.

Recommendations As a temporary mitigation, restrict access to the nvmet auth negotiate() function or the NVMe target authentication modules until a patch is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.