CVE-2026-90230: nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix heap out-of-bounds read in nvmetauthnegotiate()
nvmetexecuteauthsend() allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length (tl) and hands it to nvmetauthnegotiate() without passing tl along. nvmetauthnegotiate() then reads the negotiate header and, for each of the halen hash identifiers and dhlen DH group identifiers, indexes into the fixed idlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).
Neither the transfer length nor halen/dhlen is validated. A malicious or non-conformant host can report a tl smaller than the negotiate structure, or a halen/dhlen larger than the array (both are u8, up to 255), making the loops read past the end of the allocated buffer (heap out-of-bounds read). The sibling nvmetauthreply() already validates tl against the structure size; the negotiate path did not.
Pass tl into nvmetauthnegotiate(), reject a tl that does not cover the negotiate data plus one full protocol descriptor, and reject halen/dhlen larger than NVMEAUTHDHCHAPMAXDHIDS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In nvmet_auth_negotiate(), validate the host-supplied transfer length (tl) by rejecting any tl that is smaller than the negotiate structure plus one full protocol descriptor.
nvmet_auth_negotiate() tl validation against negotiate structure = reject tl that does not cover the negotiate data plus one full protocol descriptor - Configuration
In nvmet_auth_negotiate(), reject host-supplied halen/dhlen values that are larger than NVME_AUTH_DHCHAP_MAX_DH_IDS to prevent out-of-bounds reads when indexing idlist[60].
nvmet_auth_negotiate() halen/dhlen bounds = reject halen/dhlen larger than NVME_AUTH_DHCHAP_MAX_DH_IDS - Configuration
Modify the call path so nvmet_auth_negotiate() receives the transfer length (tl) and uses it for validation (the text notes the negotiate path did not pass tl along).
nvmet_auth_negotiate() tl parameter propagation = pass tl into nvmet_auth_negotiate() and reject invalid values
Event History
Frequently Asked Questions
Who can trigger this issue?
A malicious or non-conformant NVMe host can trigger it by sending a crafted DH-HMAC-CHAP negotiate message to the kernel NVMe target authentication path.
What malformed inputs are involved?
The host can provide a transfer length smaller than the negotiate structure, or set the halen or dhlen identifier counts above the supported DH identifier limit. These values can cause reads beyond the heap-allocated message buffer.
What does the fix validate?
The fix passes the transfer length into nvmet_auth_negotiate(), rejects messages that do not contain the negotiate data plus one full protocol descriptor, and rejects halen or dhlen values larger than NVME_AUTH_DHCHAP_MAX_DH_IDS.