Answer in brief
CVE-2026-80791 records a Unknown severity vulnerability in nvmet-auth: zero the AUTH_RECEIVE response buffer. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <447b668faa14710f611e714031e3739ac3ec3a4f || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <8f6363c8d54dde95982f0ab45e77cf57ec0efd62 || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <dfcf013f77709ebdb282767edc2795a37cab5b57 || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <b26189d28442183a8b5edb754f4a6918f77ca84e || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <2dcc9226203da7275a9c29d20007da278d73d5e9 || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <1d6837d98bf966a041af65de5f78de7409ff83bc || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <3ddcfb013322aa37eaa7a0d344b73079c38dfa21 | 447b668faa14710f611e714031e3739ac3ec3a4f, 8f6363c8d54dde95982f0ab45e77cf57ec0efd62, dfcf013f77709ebdb282767edc2795a37cab5b57, b26189d28442183a8b5edb754f4a6918f77ca84e, 2dcc9226203da7275a9c29d20007da278d73d5e9, 1d6837d98bf966a041af65de5f78de7409ff83bc, 3ddcfb013322aa37eaa7a0d344b73079c38dfa21 |
| Linux/Linuxgeneric | 6.0 | Not reported |
Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 4, 2026
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTH_RECEIVE response buffer nvmet_execute_auth_receive() allocates the response buffer with kmalloc() sized by the host-supplied AUTH_RECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size message into it. The full allocation length is then copied to the wire by nvmet_copy_to_sgl(), so a remote initiator receives the bytes past the built message -- up to nearly a page of uninitialized slab -- during the pre-authentication handshake. Allocate the buffer with kzalloc() so the unwritten tail is zeroed before it is sent; conforming responses are unaffected.
Quoted source text, attributed separately from HOL analysis.