CVE-2026-98725

A flaw was found in the Linux kernel's NVMe over Fabrics (NVMe-oF) target authentication component. A remote attacker connecting to the NVMe target service can exploit this vulnerability by sending a crafted authentication request, causing a Denial of Service (DoS) through a system crash or potential memory corruption. This issue occurs due to an incorrect buffer size calculation during authentication challenge processing, which allows an undersized buffer to bypass validation checks and results in an out-of-bounds write.

This vulnerability is rated as Important severity because an unauthenticated remote attacker on the network can trigger a kernel panic or corrupt kernel memory, resulting in a system-wide denial of service. In typical Red Hat Enterprise Linux deployments, NVMe over Fabrics target mode is not enabled by default and requires explicit administrator configuration to export storage and process authentication. Only systems specifically configured to operate as NVMe-oF targets with in-band authentication are exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.