CVE-2026-80791

A flaw was found in the Linux kernel's nvmet-auth subsystem. During the pre-authentication handshake, a remote attacker can exploit an issue where the system allocates a response buffer but only partially initializes it. The uninitialized portion of this buffer is then transmitted to the remote initiator. This can lead to the disclosure of sensitive information from kernel memory.

An information disclosure flaw exists in the NVMe/TCP target authentication path because nvmet_execute_auth_receive allocates the AUTH_RECEIVE response buffer with kmalloc using a host supplied allocation length. The DH-HMAC-CHAP response builders write only the actual fixed size authentication message, but the full allocation length is later copied back to the initiator. A remote initiator can therefore receive uninitialized kernel slab bytes past the valid response during the pre-authentication handshake, potentially up to nearly one page per request. For the CVSS the PR:N is used because the issue can be reached before successful authentication and does not require privileges beyond access to the exposed NVMe target endpoint. AV:A is used because NVMe/TCP targets are typically deployed on isolated storage or data center networks rather than the public Internet. Impact is confidentiality loss through kernel memory disclosure. No direct integrity or availability impact is indicated by the code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.