{"id":"CVE-2026-98725","aliases":[],"cve":{"records":[{"id":"CVE-2026-98725","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.366Z","published":"2026-10-18T15:47:02.735Z","modified":"2026-10-30T12:39:06.682Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:39:06.682Z"}],"references":[{"url":"https://git.kernel.org/stable/c/e94ff1771c4cb398749789557f0b6feb871e3486","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/ef4dfad231a787aded76e5b03788ddb18c8aebab","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/9d61131acd742cf97ee64e453383e41b46568513","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/8a9b4c0eef19c207663c1ee888257307c869ca86","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/fa6778e030bed9841ddcdf96bc7018da9ac03562","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.3"}]}]}]}],"prioritization":[]},"title":"nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to one with GCC and undercounts the fixed\nchallenge header by 15 bytes.  A short AUTH_RECEIVE buffer can pass the\ncheck before the challenge is copied past the end of its allocation.\n\nUse the typed challenge pointer when calculating the response size.\n\n  BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  Write of size 32 by task kworker/1:1H/64\n  Workqueue: nvmet_tcp_wq nvmet_tcp_io_work\n  Call Trace:\n  nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)\n  nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)\n  process_one_work (kernel/workqueue.c:3322)\n  worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n  kthread (kernel/kthread.c:436)\n  ret_from_fork (arch/x86/kernel/process.c:158)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n  The buggy address is located 16 bytes inside of\n   allocated 33-byte region [ffff888000554e80, ffff888000554ea1)\n  Kernel panic - not syncing: KASAN: panic_on_warn set ...","score":null,"severity":"unknown","published":"2026-10-18T15:47:02.735Z","modified":"2026-10-30T12:39:06.682Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"e94ff1771c4cb398749789557f0b6feb871e3486","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"ef4dfad231a787aded76e5b03788ddb18c8aebab","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"9d61131acd742cf97ee64e453383e41b46568513","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"8a9b4c0eef19c207663c1ee888257307c869ca86","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","status":"affected","lessThan":"fa6778e030bed9841ddcdf96bc7018da9ac03562","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98725"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98725"}],"remediation":[],"references":["https://git.kernel.org/stable/c/e94ff1771c4cb398749789557f0b6feb871e3486","https://git.kernel.org/stable/c/ef4dfad231a787aded76e5b03788ddb18c8aebab","https://git.kernel.org/stable/c/9d61131acd742cf97ee64e453383e41b46568513","https://git.kernel.org/stable/c/7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4","https://git.kernel.org/stable/c/8a9b4c0eef19c207663c1ee888257307c869ca86","https://git.kernel.org/stable/c/fa6778e030bed9841ddcdf96bc7018da9ac03562"],"sources":[{"name":"CVE","id":"CVE-2026-98725","modified":"2026-10-30T12:39:06.682Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-98725"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T14:04:30.936Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The Linux kernel's nvmet-auth is vulnerable to an out-of-bounds write in nvmet_auth_challenge(), potentially causing a kernel panic. Affected versions include Linux kernel 6.0. The vulnerability requires access to the nvmet-auth module.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T15:11:23.351Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-98725"}]}}