# CVE-2026-90230: nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

> A malicious host can trigger a heap out-of-bounds read in the Linux kernel NVMe target driver, potentially leaking memory or causing a crash.

- **Severity:** Critical 9.1 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 17 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-102626, BELL-CVE-2026-90230, DEBIAN-CVE-2026-90230, GHSA-rrv7-jqj6-x46g, UBUNTU-CVE-2026-90230

## What is CVE-2026-90230?

CVE-2026-90230 is a critical memory corruption vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

nvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with
the host-supplied transfer length (tl) and hands it to
nvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate()
then reads the negotiate header and, for each of the halen hash
identifiers and dhlen DH group identifiers, indexes into the fixed
idlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).

Neither the transfer length nor halen/dhlen is validated. A malicious or
non-conformant host can report a tl smaller than the negotiate structure,
or a halen/dhlen larger than the array (both are u8, up to 255), making
the loops read past the end of the allocated buffer (heap out-of-bounds
read). The sibling nvmet_auth_reply() already validates tl against the
structure size; the negotiate path did not.

Pass tl into nvmet_auth_negotiate(), reject a tl that does not cover the
negotiate data plus one full protocol descriptor, and reject halen/dhlen
larger than NVME_AUTH_DHCHAP_MAX_DH_IDS.

## Which versions are affected by CVE-2026-90230?


## How do I fix CVE-2026-90230?

Apply the vendor's patch.

## Is CVE-2026-90230 being exploited?

There is no known exploitation of CVE-2026-90230 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-90230 and fix it if it is affected.

What it is: CVE-2026-90230 is a critical memory corruption vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-90230 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-90230/ (Markdown: https://insights.sbomify.com/CVE-2026-90230/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-90230
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90230
- OSV: https://osv.dev/vulnerability/CVE-2026-90230

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-90230/
Summaries are generated and may contain mistakes; the official description above is the record.