Answer in brief
CVE-2026-98725 records a Unknown severity vulnerability in nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <9d61131acd742cf97ee64e453383e41b46568513 || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4 || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <8a9b4c0eef19c207663c1ee888257307c869ca86 || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <fa6778e030bed9841ddcdf96bc7018da9ac03562 | 9d61131acd742cf97ee64e453383e41b46568513, 7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4, 8a9b4c0eef19c207663c1ee888257307c869ca86, fa6778e030bed9841ddcdf96bc7018da9ac03562 |
| Linux/Linuxgeneric | 6.0 | Not reported |
| Linux/Linuxgeneric | >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <ef4dfad231a787aded76e5b03788ddb18c8aebab || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <9d61131acd742cf97ee64e453383e41b46568513 || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4 || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <8a9b4c0eef19c207663c1ee888257307c869ca86 || >=db1312dd95488b5e6ff362ff66fcf953a46b1821 <fa6778e030bed9841ddcdf96bc7018da9ac03562 | ef4dfad231a787aded76e5b03788ddb18c8aebab, 9d61131acd742cf97ee64e453383e41b46568513, 7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4, 8a9b4c0eef19c207663c1ee888257307c869ca86, fa6778e030bed9841ddcdf96bc7018da9ac03562 |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the check before the challenge is copied past the end of its allocation. Use the typed challenge pointer when calculating the response size. BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) Write of size 32 by task kworker/1:1H/64 Workqueue: nvmet_tcp_wq nvmet_tcp_io_work Call Trace: nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243) nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) The buggy address is located 16 bytes inside of allocated 33-byte region [ffff888000554e80, ffff888000554ea1) Kernel panic - not syncing: KASAN: panic_on_warn set ...
Quoted source text, attributed separately from HOL analysis.