Към съдържанието
Търсене

CVE-2026-72130: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF initiator reach the fixed-size DH-HMAC-CHAP response builders with a kmalloc() buffer shorter than the response, so nvmet_auth_success1() and nvmet_auth_failure1() write past the allocation; both only WARN_ON the short length and then format the message anyway. Impact: A remote NVMe-oF initiator with access to an auth-enabled target can trigger a 16-byte heap out-of-bounds write via a one-byte AUTH_RECEIVE allocation length. Compute the minimum response length for the current DH-HMAC-CHAP step in nvmet_auth_receive_data_len() and report a zero data length when the host-supplied allocation length is shorter, so the existing zero-length check in nvmet_execute_auth_receive() rejects the command before any builder runs. The SUCCESS1 minimum is sizeof(struct nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the response hash is written into the rval[] flexible-array tail, so the minimum is state dependent rather than a flat sizeof. CHALLENGE keeps its existing variable-length guard in nvmet_auth_challenge(). This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.

Засегнати продукти

  • Linux Linux: db1312dd95488b5e6ff362ff66fcf953a46b1821 преди ecdb6332fe59ddf18aad758a4926e3d483f4860a; db1312dd95488b5e6ff362ff66fcf953a46b1821 преди 584d7d14d9b40b080b1195cec83de86ade63343e; db1312dd95488b5e6ff362ff66fcf953a46b1821 преди 80bf7b7f676e3987bbe06af3c359bd56ac91a5a9; db1312dd95488b5e6ff362ff66fcf953a46b1821 преди 2eaa3ad450141cfcf187bb43cb8335eb336b5f87; db1312dd95488b5e6ff362ff66fcf953a46b1821 преди bc111698b46e43eddd8664cceaa621cd559e99a0; db1312dd95488b5e6ff362ff66fcf953a46b1821 преди 779575bc35c687697ba69e904f2cd22e60112534
  • Linux Linux: 6.0; преди 6.0; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.101 до 6.12.*; 6.18.40 до 6.18.*; 7.1.5 до 7.1.*; от 7.2 нататък

История

  • 15 август 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-72130: Linux | freedomonline.bg