{"id":"CVE-2026-98725","state":"PUBLISHED","title":"nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to one with GCC and undercounts the fixed\nchallenge header by 15 bytes.  A short AUTH_RECEIVE buffer can pass the\ncheck before the challenge is copied past the end of its allocation.\n\nUse the typed challenge pointer when calculating the response size.\n\n  BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  Write of size 32 by task kworker/1:1H/64\n  Workqueue: nvmet_tcp_wq nvmet_tcp_io_work\n  Call Trace:\n  nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)\n  nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)\n  process_one_work (kernel/workqueue.c:3322)\n  worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n  kthread (kernel/kthread.c:436)\n  ret_from_fork (arch/x86/kernel/process.c:158)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n  The buggy address is located 16 bytes inside of\n   allocated 33-byte region [ffff888000554e80, ffff888000554ea1)\n  Kernel panic - not syncing: KASAN: panic_on_warn set ...","publishedAt":"2026-10-18T15:47:02.735Z","updatedAt":"2026-10-30T12:39:06.682Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"e94ff1771c4cb398749789557f0b6feb871e3486","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"ef4dfad231a787aded76e5b03788ddb18c8aebab","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"9d61131acd742cf97ee64e453383e41b46568513","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"8a9b4c0eef19c207663c1ee888257307c869ca86","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"fa6778e030bed9841ddcdf96bc7018da9ac03562","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/fabrics-cmd-auth.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/fabrics-cmd-auth.c"]}],"references":["https://git.kernel.org/stable/c/e94ff1771c4cb398749789557f0b6feb871e3486","https://git.kernel.org/stable/c/ef4dfad231a787aded76e5b03788ddb18c8aebab","https://git.kernel.org/stable/c/9d61131acd742cf97ee64e453383e41b46568513","https://git.kernel.org/stable/c/7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4","https://git.kernel.org/stable/c/8a9b4c0eef19c207663c1ee888257307c869ca86","https://git.kernel.org/stable/c/fa6778e030bed9841ddcdf96bc7018da9ac03562"],"weaknesses":[],"ingestedAt":"2026-10-30T12:58:04.520Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98725.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98725","state":"PUBLISHED","datePublished":"2026-10-18T15:47:02.735Z","dateUpdated":"2026-10-30T12:39:06.682Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.366Z"},"containers":{"cna":{"title":"nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to one with GCC and undercounts the fixed\nchallenge header by 15 bytes.  A short AUTH_RECEIVE buffer can pass the\ncheck before the challenge is copied past the end of its allocation.\n\nUse the typed challenge pointer when calculating the response size.\n\n  BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  Write of size 32 by task kworker/1:1H/64\n  Workqueue: nvmet_tcp_wq nvmet_tcp_io_work\n  Call Trace:\n  nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)\n  nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)\n  process_one_work (kernel/workqueue.c:3322)\n  worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n  kthread (kernel/kthread.c:436)\n  ret_from_fork (arch/x86/kernel/process.c:158)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n  The buggy address is located 16 bytes inside of\n   allocated 33-byte region [ffff888000554e80, ffff888000554ea1)\n  Kernel panic - not syncing: KASAN: panic_on_warn set ..."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"e94ff1771c4cb398749789557f0b6feb871e3486","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"ef4dfad231a787aded76e5b03788ddb18c8aebab","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"9d61131acd742cf97ee64e453383e41b46568513","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"8a9b4c0eef19c207663c1ee888257307c869ca86","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"fa6778e030bed9841ddcdf96bc7018da9ac03562","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/fabrics-cmd-auth.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/fabrics-cmd-auth.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e94ff1771c4cb398749789557f0b6feb871e3486"},{"url":"https://git.kernel.org/stable/c/ef4dfad231a787aded76e5b03788ddb18c8aebab"},{"url":"https://git.kernel.org/stable/c/9d61131acd742cf97ee64e453383e41b46568513"},{"url":"https://git.kernel.org/stable/c/7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4"},{"url":"https://git.kernel.org/stable/c/8a9b4c0eef19c207663c1ee888257307c869ca86"},{"url":"https://git.kernel.org/stable/c/fa6778e030bed9841ddcdf96bc7018da9ac03562"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:39:06.682Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}