{"apiVersion":"1.0","identifier":"CVE-2026-72130","description":"In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF initiator reach the fixed-size DH-HMAC-CHAP response builders with a kmalloc() buffer shorter than the response, so nvmet_auth_success1() and nvmet_auth_failure1() write past the allocation; both only WARN_ON the short length and then format the message anyway. Impact: A remote NVMe-oF initiator with access to an auth-enabled target can trigger a 16-byte heap out-of-bounds write via a one-byte AUTH_RECEIVE allocation length. Compute the minimum response length for the current DH-HMAC-CHAP step in nvmet_auth_receive_data_len() and report a zero data length when the host-supplied allocation length is shorter, so the existing zero-length check in nvmet_execute_auth_receive() rejects the command before any builder runs. The SUCCESS1 minimum is sizeof(struct nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the response hash is written into the rval[] flexible-array tail, so the minimum is state dependent rather than a flat sizeof. CHALLENGE keeps its existing variable-length guard in nvmet_auth_challenge(). This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.","publishedAt":"2026-08-15T06:21:30","lastModifiedAt":"2026-08-17T06:18:12","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72130","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00728,"riskScore":1.04,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72130","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72130","en":"https://www.redsauce.net/en/cves/CVE-2026-72130","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72130","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72130","de":"https://www.redsauce.net/de/cves/CVE-2026-72130","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72130","el":"https://www.redsauce.net/el/cves/CVE-2026-72130"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72130"}}