CVE-2026-80791: nvmet-auth: zero the AUTH_RECEIVE response buffer
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: zero the AUTHRECEIVE response buffer
nvmetexecuteauthreceive() allocates the response buffer with kmalloc() sized by the host-supplied AUTHRECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size message into it. The full allocation length is then copied to the wire by nvmetcopytosgl(), so a remote initiator receives the bytes past the built message -- up to nearly a page of uninitialized slab -- during the pre-authentication handshake.
Allocate the buffer with kzalloc() so the unwritten tail is zeroed before it is sent; conforming responses are unaffected.
Affected Software
Event History
Frequently Asked Questions
Who can retrieve the uninitialized memory?
A remote NVMe initiator can receive the unwritten portion of the AUTH_RECEIVE response buffer during the pre-authentication handshake. The exposure occurs before authentication completes.
What does an attacker need to control to exploit the disclosure?
The initiator supplies the AUTH_RECEIVE allocation length. If that length exceeds the fixed-size DH-HMAC-CHAP message built by the target, the excess bytes copied to the wire may contain uninitialized slab memory.
Does exploitation alter valid authentication responses?
No. The fix changes allocation from kmalloc() to kzalloc() so only the unwritten response-buffer tail is zeroed; conforming response contents are unaffected.
What should be done if the fix cannot be applied immediately?
The provided data identifies exposure through remote AUTH_RECEIVE requests during the pre-authentication handshake. Restricting access to the NVMe target to trusted initiators can limit who can make those requests.