1. Home
  2. Vulnerabilities
  3. CVE-2026-72130
9.8
CRITICAL CVSS 3.1
CVE-2026-72130
nvmet-auth: reject short AUTH_RECEIVE buffers
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF initiator reach the fixed-size DH-HMAC-CHAP response builders with a kmalloc() buffer shorter than the response, so nvmet_auth_success1() and nvmet_auth_failure1() write past the allocation; both only WARN_ON the short length and then format the message anyway. Impact: A remote NVMe-oF initiator with access to an auth-enabled target can trigger a 16-byte heap out-of-bounds write via a one-byte AUTH_RECEIVE allocation length. Compute the minimum response length for the current DH-HMAC-CHAP step in nvmet_auth_receive_data_len() and report a zero data length when the host-supplied allocation length is shorter, so the existing zero-length check in nvmet_execute_auth_receive() rejects the command before any builder runs. The SUCCESS1 minimum is sizeof(struct nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the response hash is written into the rval[] flexible-array tail, so the minimum is state dependent rather than a flat sizeof. CHALLENGE keeps its existing variable-length guard in nvmet_auth_challenge(). This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.

Details
INFO

Published Date :

Aug. 15, 2026, 6:21 a.m.

Last Modified :

Aug. 17, 2026, 6:18 a.m.

Remotely Exploit :

Yes !

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-72130 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Update the Linux kernel to prevent heap buffer overflows during authentication.
  • Update the Linux kernel to the latest version.
  • Ensure in-band DH-HMAC-CHAP authentication is configured securely.
  • Verify authentication responses are handled correctly.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-72130.

URL Resource
https://git.kernel.org/stable/c/2eaa3ad450141cfcf187bb43cb8335eb336b5f87
https://git.kernel.org/stable/c/779575bc35c687697ba69e904f2cd22e60112534
https://git.kernel.org/stable/c/80bf7b7f676e3987bbe06af3c359bd56ac91a5a9
https://git.kernel.org/stable/c/bc111698b46e43eddd8664cceaa621cd559e99a0
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-72130 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-72130 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-72130 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-72130 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': '80bf7b7f676e3987bbe06af3c359bd56ac91a5a9', 'versionType': 'git'}, {'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': '2eaa3ad450141cfcf187bb43cb8335eb336b5f87', 'versionType': 'git'}, {'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': 'bc111698b46e43eddd8664cceaa621cd559e99a0', 'versionType': 'git'}, {'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': '779575bc35c687697ba69e904f2cd22e60112534', 'versionType': 'git'}], 'programFiles': ['drivers/nvme/target/fabrics-cmd-auth.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/nvme/target/fabrics-cmd-auth.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': '80bf7b7f676e3987bbe06af3c359bd56ac91a5a9', 'versionType': 'git'}, {'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': '2eaa3ad450141cfcf187bb43cb8335eb336b5f87', 'versionType': 'git'}, {'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': 'bc111698b46e43eddd8664cceaa621cd559e99a0', 'versionType': 'git'}, {'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': '779575bc35c687697ba69e904f2cd22e60112534', 'versionType': 'git'}], 'programFiles': ['drivers/nvme/target/fabrics-cmd-auth.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/nvme/target/fabrics-cmd-auth.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': '80bf7b7f676e3987bbe06af3c359bd56ac91a5a9', 'versionType': 'git'}, {'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': '2eaa3ad450141cfcf187bb43cb8335eb336b5f87', 'versionType': 'git'}, {'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': 'bc111698b46e43eddd8664cceaa621cd559e99a0', 'versionType': 'git'}, {'status': 'affected', 'version': 'db1312dd95488b5e6ff362ff66fcf953a46b1821', 'lessThan': '779575bc35c687697ba69e904f2cd22e60112534', 'versionType': 'git'}], 'programFiles': ['drivers/nvme/target/fabrics-cmd-auth.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/nvme/target/fabrics-cmd-auth.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF initiator reach the fixed-size DH-HMAC-CHAP response builders with a kmalloc() buffer shorter than the response, so nvmet_auth_success1() and nvmet_auth_failure1() write past the allocation; both only WARN_ON the short length and then format the message anyway. Impact: A remote NVMe-oF initiator with access to an auth-enabled target can trigger a 16-byte heap out-of-bounds write via a one-byte AUTH_RECEIVE allocation length. Compute the minimum response length for the current DH-HMAC-CHAP step in nvmet_auth_receive_data_len() and report a zero data length when the host-supplied allocation length is shorter, so the existing zero-length check in nvmet_execute_auth_receive() rejects the command before any builder runs. The SUCCESS1 minimum is sizeof(struct nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the response hash is written into the rval[] flexible-array tail, so the minimum is state dependent rather than a flat sizeof. CHALLENGE keeps its existing variable-length guard in nvmet_auth_challenge(). This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.
    Added Reference https://git.kernel.org/stable/c/2eaa3ad450141cfcf187bb43cb8335eb336b5f87
    Added Reference https://git.kernel.org/stable/c/779575bc35c687697ba69e904f2cd22e60112534
    Added Reference https://git.kernel.org/stable/c/80bf7b7f676e3987bbe06af3c359bd56ac91a5a9
    Added Reference https://git.kernel.org/stable/c/bc111698b46e43eddd8664cceaa621cd559e99a0
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact