CVE-2026-80791 nvmet-auth: zero the AUTH_RECEIVE response buffer
A remote attacker can read uninitialized kernel memory during the NVMe-oF authentication handshake, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80791?
CVE-2026-80791 is a vulnerability in Linux, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: zero the AUTH_RECEIVE response buffer
nvmet_execute_auth_receive() allocates the response buffer with kmalloc() sized by the host-supplied AUTH_RECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size message into it. The full allocation length is then copied to the wire by nvmet_copy_to_sgl(), so a remote initiator receives the bytes past the built message -- up to nearly a page of uninitialized slab -- during the pre-authentication handshake.
Allocate the buffer with kzalloc() so the unwritten tail is zeroed before it is sent; conforming responses are unaffected.
Which versions are affected by CVE-2026-80791?
How do I fix CVE-2026-80791?
Apply the vendor's patch.
Is CVE-2026-80791 being exploited?
There is no known exploitation of CVE-2026-80791 in the wild and no public exploit code.
Sources
Also known as AZL-99606, BELL-CVE-2026-80791, DEBIAN-CVE-2026-80791, GHSA-6r74-cc8q-38c5, UBUNTU-CVE-2026-80791.