External risk intelligence

Linux Kernel NVMe-oF Authentication Buffer Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72130

The vulnerability affects NVMe-oF target authentication. While the attack vector is network-based, NVMe-oF is typically deployed in isolated data center or SAN environments. Reachability requires specific in-band authentication configurations, making public internet exposure atypical, though potential if misconfigured.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE addresses a vulnerability in the Linux kernel related to NVMe-oF target authentication. A remote attacker could exploit this by sending a specially crafted authentication request, potentially leading to a heap out-of-bounds write. The issue is triggered when in-band DH-HMAC-CHAP authentication is configured on the target.

Short authentication buffers can cause data writes beyond allocated memory.
Affects NVMe-oF target authentication configuration.
Confirm relevance and exposure if authentication is used.

Attack Path

How an attacker could exploit the issue

An attacker with network access to an NVMe-oF target configured for in-band DH-HMAC-CHAP authentication could craft a specific request. This request would exploit a flaw in how the system handles the buffer size for authentication responses, leading to a heap out-of-bounds write. This vulnerability is reachable without any special privileges or user interaction.

Network access required.
Authentication buffer size flaw.
Heap out-of-bounds write risk.

Live Threat

Current exploitation, exposure, and threat context

A remote NVMe-oF initiator with access to an auth-enabled target could trigger a heap out-of-bounds write. This may occur when a short buffer is provided for authentication responses, allowing data to be written past the allocated memory. This vulnerability is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.

Heap memory
Incorrect buffer length processing
Potential memory corruption

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's nvmet-auth component is vulnerable to a heap out-of-bounds write when handling authentication requests. This vulnerability requires in-band DH-HMAC-CHAP authentication to be configured on the target and can be exploited by a remote NVMe-oF initiator with access to an auth-enabled target. The first practical step is to identify all NVMe-oF targets, confirm if they use DH-HMAC-CHAP authentication, assess their network exposure, and then plan remediation with the infrastructure or storage platform teams responsible for the NVMe-oF environment.

Own by Infrastructure/Platform teams.
Verify DH-HMAC-CHAP authentication configuration.
Plan and implement kernel updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the nvmet-auth component in the Linux kernel?

The nvmet-auth component is part of the Linux kernel's NVMe over Fabrics (NVMe-oF) subsystem. It specifically handles the authentication process between an NVMe-oF target—which provides storage—and an initiator, the system requesting that storage. It uses the DH-HMAC-CHAP protocol to verify the identity of devices connecting over the network, ensuring that only authorized initiators can access the storage target.

How does CVE-2026-72130 lead to a memory corruption issue?

This vulnerability is an improper input validation flaw. When a remote initiator sends an authentication request, the software allocates a buffer to store the response. The system fails to verify that this buffer is large enough for the data it expects to write. Consequently, if an initiator provides an undersized buffer, the kernel writes data beyond the allocated memory's boundary, resulting in a heap out-of-bounds write.

Do I need to worry if my system does not use DH-HMAC-CHAP?

No. This vulnerability is strictly tied to the authentication handshake process. It only triggers when in-band DH-HMAC-CHAP authentication is explicitly enabled and configured on an NVMe-oF target. If your targets are configured to allow connections without this specific authentication mechanism, the vulnerable code path that processes these short, malicious buffers is not invoked.

Why does Halo Surface Signal categorize this as only Possible?

While the vulnerability is technically network-reachable, Halo Surface Signal notes that NVMe-oF is typically deployed within isolated data center or storage area network (SAN) environments rather than exposed directly to the public internet. Because the flaw requires both a specific authentication configuration and network access to an NVMe-oF target, broad exposure is atypical.

How should I prioritize responding to this CVE?

Start by identifying all NVMe-oF targets in your environment to see which ones have in-band DH-HMAC-CHAP authentication enabled. For those that do, coordinate with your infrastructure or platform teams to assess their network accessibility. The most effective resolution is to update the Linux kernel, as the fix involves correctly calculating and enforcing minimum buffer size requirements during the authentication process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.