CVE-2026-72130

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTH_RECEIVE buffer to an NVMe-oF (NVM Express over Fabrics) target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the system incorrectly processes the provided buffer length, leading to memory corruption. This can result in a denial of service or other unpredictable system behavior.

Red Hat has rated this vulnerability as Important because a remote network initiator can cause out-of-bounds heap memory corruption in the kernel, potentially resulting in system crashes or arbitrary execution. By default, Red Hat Enterprise Linux does not configure or run NVMe over Fabrics target functionality. Exploitation is constrained to systems explicitly set up as an NVMe-oF target with in-band DH-HMAC-CHAP authentication enabled on listening ports.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that in-band DH-HMAC-CHAP authentication is not configured on NVMe-oF targets if it is not strictly required. This vulnerability is only exploitable when this specific authentication mechanism is enabled. Consult NVMe-oF documentation for your specific setup to disable DH-HMAC-CHAP authentication if it is currently enabled and not required.