CVE-2023-5178

CVE-2023-5178 The exploit for CVE-2023-5178: NVMe-oF-TCP vulnerability, which is a logic error in NVMe-oF-TCP driver during the handle of corrupted Initialize Connection Request. It leads to racy double-free in kmalloc-96 , which can be exploited to gain LPEsee demo below. The exploit targets...

DEBIAN-CVE-2026-89971

In the Linux kernel, the following vulnerability has been resolved: nvme: skip the zoned limits update if the zone info query failed nvmequeryzoneinfo returns either a negative errno or a positive NVMe status code, but nvmeupdatensinfoblock only tests for the negative case: ret =...

kernel: nvmet-auth: validate reply message payload bounds against transfer length

A flaw was found in the Linux kernel's nvmet-auth component. A remote attacker, by sending a specially crafted NVMe-oF NVMe over Fabrics authentication reply message, can cause an out-of-bounds read in the kernel's memory. This vulnerability, exploitable pre-authentication, can lead to the...

kernel: nvmet-auth: validate reply message payload bounds against transfer length

A flaw was found in the Linux kernel's nvmet-auth component. A remote attacker, by sending a specially crafted NVMe-oF NVMe over Fabrics authentication reply message, can cause an out-of-bounds read in the kernel's memory. This vulnerability, exploitable pre-authentication, can lead to the...

CVE-2026-80791

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTHRECEIVE response buffer nvmetexecuteauthreceive allocates the response buffer with kmalloc sized by the host-supplied AUTHRECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size...

EUVD-2026-71434

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTHRECEIVE response buffer nvmetexecuteauthreceive allocates the response buffer with kmalloc sized by the host-supplied AUTHRECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size...

kernel: nvmet-auth: reject short AUTH_RECEIVE buffers

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

kernel: nvmet-auth: reject short AUTH_RECEIVE buffers

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

RLSA-2026:59821 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: sctp: purge outqueue on stale COOKIE-ECHO handling CVE-2026-52924 kernel: scsi: target: iscsi: Validate CHAPR length before base64 decode CVE-2026-63886 kernel: netfilter: conntrack: tcp:...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Rejects short AUTHRECEIVE buffers. The nvmetexecuteauthreceive function relies on the AUTHRECEIVE allocation length. It only checks whether the length is non-zero and matches the transfer length. In the SUCCESS1 and...

SUSE CVE-2026-72130

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...

CVE-2026-72130

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

CVE-2026-72128

A flaw was found in the nvmet NVMe over Fabrics target component of the Linux kernel. This vulnerability occurs in the nvmetsqcreate function, where a reference to a controller object is not properly released if a specific check fails. An attacker could potentially exploit this reference count le...

CVE-2026-72130

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...

CVE-2026-72129

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

CVE-2026-72130

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...

UBUNTU-CVE-2026-72130

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...

CVE-2026-72130 nvmet-auth: reject short AUTH_RECEIVE buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...

CVE-2026-72130 nvmet-auth: reject short AUTH_RECEIVE buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...

CVE-2026-72130

CVE-2026-72130 : In the Linux kernel, the nvmet-auth path is affected. A flaw in nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length, allowing a remote NVMe-oF initiator to trigger a 16-byte heap out-of-bounds write by using a one-byte AUTH_RECEIVE allocation leng...