{"id":25639,"date":"2026-09-18T04:31:40","date_gmt":"2026-09-17T20:31:40","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90230"},"modified":"2026-09-18T04:31:40","modified_gmt":"2026-09-17T20:31:40","slug":"cve-2026-90230","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90230","title":{"rendered":"CVE-2026-90230 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix heap out-o"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()<\/p>\n<p>nvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with<br \/>\nthe host-supplied transfer length (tl) and hands it to<br \/>\nnvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate()<br \/>\nthen reads the negotiate header and, for each of the halen hash<br \/>\nidentifiers and dhlen DH group identifiers, indexes into the fixed<br \/>\nidlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).<\/p>\n<p>Neither the transfer length nor halen\/dhlen is validated. A malicious or<br \/>\nnon-conformant host can report a tl smaller than the negotiate structure,<br \/>\nor a halen\/dhlen larger than the array (both are u8, up to 255), making<br \/>\nthe loops read past the end of the allocated buffer (heap out-of-bounds<br \/>\nread). The sibling nvmet_auth_reply() already validates tl against the<br \/>\nstructure size; the negotiate path did not.<\/p>\n<p>Pass tl into nvmet_auth_negotiate(), reject a tl that does not cover the<br \/>\nnegotiate data plus one full protocol descriptor, and reject halen\/dhlen<br \/>\nlarger than NVME_AUTH_DHCHAP_MAX_DH_IDS.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()<\/p>\n<p>nvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer w<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25639","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}