73 matches found
kernel: nvmet-auth: reject short AUTH_RECEIVE buffers
A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...
Important: Red Hat Security Advisory: kernel-rt security update
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
RHEL 9 : kernel-rt (RHSA-2026:82860)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82860 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...
Oracle Linux 9 : kernel (ELSA-2026-81552)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-81552 advisory. - nvmet-auth: Synchronize timeout work during SQ teardown CKI Backport Bot RHEL-276348 CVE-2026-89970 - drm/amdkfd: Add TLB flush after MES queue...
Oracle Linux 10 : kernel (ELSA-2026-81406)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-81406 advisory. - nvmet-auth: Synchronize timeout work during SQ teardown CKI Backport Bot RHEL-276363 CVE-2026-89970 - thermal: core: Fix thermal zone device...
kernel: nvmet-auth: Synchronize timeout work during SQ teardown
A flaw was found in the nvmet-auth component of the Linux kernel. A timing issue during the cleanup of a Submission Queue SQ can lead to a use-after-free vulnerability. This occurs when a delayed authentication task attempts to access memory that has already been released or repurposed. An attack...
kernel security, bug fix, and enhancement update
6.12.0-211.65.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...
kernel: nvmet-auth: Synchronize timeout work during SQ teardown
A flaw was found in the nvmet-auth component of the Linux kernel. A timing issue during the cleanup of a Submission Queue SQ can lead to a use-after-free vulnerability. This occurs when a delayed authentication task attempts to access memory that has already been released or repurposed. An attack...
kernel: nvmet-auth: reject short AUTH_RECEIVE buffers
A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
kernel: nvmet-auth: reject short AUTH_RECEIVE buffers
A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...
CVE-2026-89970
A flaw was found in the nvmet-auth component of the Linux kernel. A timing issue during the cleanup of a Submission Queue SQ can lead to a use-after-free vulnerability. This occurs when a delayed authentication task attempts to access memory that has already been released or repurposed. An attack...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Assign dhkey to NULL after kfreesensitive. ctrl-dhkey may be used across multiple calls to nvmetsetupdhgroup for the same controller. Therefore, it’s better to set it to NULL after a error-free release, in order to...
kernel: nvmet-auth: reject short AUTH_RECEIVE buffers
A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...
SUSE CVE-2026-89970
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...
PT-2026-94578
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds read exists in the nvmet auth negotiate function. The nvmet execute auth send function allocates a DH-HMAC-CHAP message buffer using a host-supplied transfer length ...
CVE-2026-89970
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...
AZL-101460 CVE-2026-89970 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...
DEBIAN-CVE-2026-89970
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...
CVE-2026-89970
CVE-2026-89970 is a use-after-free vulnerability in the Linux kernel NVMe Target (nvmet) authentication subsystem. During Submission Queue (SQ) teardown, nvmet_auth_sq_free() uses cancel_delayed_work() to stop auth_expired_work, but if the work has already started, cancellation does not wait for ...