CVE-2026-90230

A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker, by sending a specially crafted NVMe-oF (NVMe over Fabrics) in-band authentication negotiation message with an invalid transfer length or identifier lengths, could trigger a heap out-of-bounds read in the nvmet_auth_negotiate() function. This vulnerability could lead to information disclosure or a denial of service.

A heap out-of-bounds read in the NVMe target authentication path occurs because nvmet_auth_negotiate can read DH-HMAC-CHAP negotiate fields and idlist entries without validating the host supplied transfer length or the halen and dhlen counters. A malicious or non conformant NVMe host can provide a too small tl or oversized identifier counts, causing reads beyond the allocated authentication buffer during negotiate processing. For the CVSS the PR:N is used because the attacker only needs protocol reachability to the NVMe target authentication endpoint and does not need a local account on the target system. The AV:A metric is used because NVMe over Fabrics targets are normally deployed on isolated storage or data center networks rather than the public Internet. Impact is at least denial of service via kernel crash or fault handling, with possible confidentiality impact from reading adjacent heap data through protocol dependent behavior. Integrity impact is not assumed because the patch shows an out-of-bounds read and length validation issue, not an out-of-bounds write or arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.