{"id":"CVE-2026-98725","kind":"vulnerability","aliases":["CVE-2026-98725"],"related":[],"title":"Linux kernel NVMe target: out-of-bounds write in NVMe-oF authentication challenge","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to one with GCC and undercounts the fixed\nchallenge header by 15 bytes.  A short AUTH_RECEIVE buffer can pass the\ncheck before the challenge is copied past the end of its allocation.\n\nUse the typed challenge pointer when calculating the response size.\n\n  BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  Write of size 32 by task kworker/1:1H/64\n  Workqueue: nvmet_tcp_wq nvmet_tcp_io_work\n  Call Trace:\n  nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)\n  nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)\n  process_one_work (kernel/workqueue.c:3322)\n  worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n  kthread (kernel/kthread.c:436)\n  ret_from_fork (arch/x86/kernel/process.c:158)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n  The buggy address is located 16 bytes inside of\n   allocated 33-byte region [ffff888000554e80, ffff888000554ea1)\n  Kernel panic - not syncing: KASAN: panic_on_warn set ...","summary":"The Linux kernel's NVMe target authentication code computes the size of its challenge response using a void pointer, undercounting the fixed header by 15 bytes. A short AUTH_RECEIVE buffer can therefore pass the size check and let the kernel write past the end of a slab allocation.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","nvme-target","nvmet-tcp","runtime","self-hosted","storage"],"not_affected_if":["initiator-only","no-nvme-target"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD record.\n- Check whether the NVMe target is in use with `nvmetcli ls` or by looking for `/sys/kernel/config/nvmet`.\n- Check whether NVMe-oF authentication (DH-HMAC-CHAP) is configured on any port or subsystem.","fix":"- Update the Linux kernel to a stable release containing the upstream commit that uses the typed challenge pointer in nvmet_auth_challenge() (exact fixed versions: unknown, see NVD).\n- Until patched, avoid exposing NVMe-oF target ports to untrusted networks.","status":"open","published_at":"2026-10-18T16:17:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:20+00:00","updated_at":"2026-10-25T05:17:20+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:17:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release containing the upstream commit that uses the typed challenge pointer in nvmet_auth_challenge() (exact fixed versions: unknown, see NVD).\n- Until patched, avoid exposing NVMe-oF target ports to untrusted networks.","reach":"network","title":"Linux kernel NVMe target: out-of-bounds write in NVMe-oF authentication challenge","impact":"high","summary":"The Linux kernel's NVMe target authentication code computes the size of its challenge response using a void pointer, undercounting the fixed header by 15 bytes. A short AUTH_RECEIVE buffer can therefore pass the size check and let the kernel write past the end of a slab allocation.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","nvme-target","nvmet-tcp","self-hosted","storage"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote network peer corrupts kernel memory, possibly crashing the host.","analyst_note":"Find the fixed kernel versions and the upstream commit in NVD or the kernel stable mailing list, and confirm whether authentication is required to reach the bug.","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD record.\n- Check whether the NVMe target is in use with `nvmetcli ls` or by looking for `/sys/kernel/config/nvmet`.\n- Check whether NVMe-oF authentication (DH-HMAC-CHAP) is configured on any port or subsystem.","needs_analyst":true,"not_affected_if":["no-nvme-target","initiator-only"],"who_is_affected":"Only hosts running the Linux kernel NVMe target (nvmet) with NVMe over Fabrics, such as TCP targets, are exposed. Hosts that only act as NVMe initiators or do not export NVMe targets can skip it. Whether authentication must be enabled to reach the vulnerable path is unknown from the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000766,"input_tokens":3956,"output_tokens":740,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98725':18A,21A '1119':214C '1243':216C '1350':222C '1382':224C '1445':226C '15':60B,134C '158':245C '16':257C '1h/64':189C '245':251C '32':185C '33':262C '3322':231C '3405':235C '3486':237C '436':240C '442':179C,205C '569':181C,207C 'address':254C 'alloc':84B,155C,261C 'arch/x86/entry/entry_64.s':250C 'arch/x86/kernel/process.c':244C 'asm':249C 'auth':64B,97C,106C,109C,138C,176C,202C 'authent':14A,42B 'bound':8A,102C,172C 'buffer':66B,114C,140C 'bug':166C 'buggi':253C 'byte':61B,135C,258C,263C 'calcul':162C 'call':198C 'challeng':15A,49B,107C,110C,131C,147C,159C 'check':72B,144C 'code':43B 'comput':44B 'copi':149C 'cve':16A,19A 'd':120C 'drivers/nvme/target/fabrics-cmd-auth.c':178C,180C,204C,206C 'drivers/nvme/target/tcp.c':213C,215C,221C,223C,225C 'end':80B,152C 'evalu':122C 'execut':175C,201C 'ffff888000554e80':265C 'ffff888000554ea1':266C 'fix':57B,98C,130C 'follow':90C 'fork':243C,248C 'gcc':126C 'header':58B,132C 'host':34B 'insid':259C 'io':196C,219C 'kasan':167C,271C 'kernel':2A,24B,38B,76B,88C,267C 'kernel/kthread.c':239C 'kernel/workqueue.c':230C,234C,236C 'kthread':238C 'kworker/1':188C 'let':74B 'linux':1A,23B,37B,87C 'linux-kernel':22B 'locat':256C 'nvme':3A,12A,26B,40B 'nvme-of':11A 'nvme-target':25B 'nvmet':29B,96C,105C,108C,174C,191C,194C,200C,208C,217C 'nvmet-auth':95C 'nvmet-tcp':28B 'one':124C,228C 'out-of-bound':5A,99C 'output':113C 'panic':268C,272C 'pass':69B,142C 'past':78B,150C 'pdu':212C 'pointer':54B,118C,160C 'process':227C 'receiv':65B,111C,139C,177C,203C 'recv':211C 'region':264C 'resolv':94C 'respons':50B,164C 'ret':241C,246C 'runtim':31B 'self':33B 'self-host':32B 'set':275C 'short':63B,137C 'size':46B,71B,165C,184C 'sizeof':119C 'slab':83B,169C 'slab-out-of-bound':168C 'storag':35B 'sync':270C 'target':4A,27B,41B 'task':187C 'tcp':30B,192C,195C,209C,218C 'therefor':68B,121C 'thread':233C 'trace':199C 'tri':210C 'type':158C 'undercount':55B,128C 'use':51B,156C 'void':53B,117C 'vulner':91C 'warn':274C 'work':197C,220C,229C 'worker':232C 'workqueu':190C 'wq':193C 'write':9A,77B,103C,182C","nicknames":[],"mitigations":[],"who_affected":"Only hosts running the Linux kernel NVMe target (nvmet) with NVMe over Fabrics, such as TCP targets, are exposed. Hosts that only act as NVMe initiators or do not export NVMe targets can skip it. Whether authentication must be enabled to reach the vulnerable path is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98725","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98725","severity":null,"published_at":"2026-10-18T16:17:26+00:00","modified_at":"2026-10-21T13:21:40+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}