{"schema":"threatline.record/2","record":{"id":"CVE-2026-98725","aliases":[],"summary":"nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to one with GCC and undercounts the fixed\nchallenge header by 15 bytes.  A short AUTH_RECEIVE buffer can pass the\ncheck before the challenge is copied past the end of its allocation.\n\nUse the typed challenge pointer when calculating the response size.\n\n  BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  Write of size 32 by task kworker/1:1H/64\n  Workqueue: nvmet_tcp_wq nvmet_tcp_io_work\n  Call Trace:\n  nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n  nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)\n  nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)\n  process_one_work (kernel/workqueue.c:3322)\n  worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n  kthread (kernel/kthread.c:436)\n  ret_from_fork (arch/x86/kernel/process.c:158)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n  The buggy address is located 16 bytes inside of\n   allocated 33-byte region [ffff888000554e80, ffff888000554ea1)\n  Kernel panic - not syncing: KASAN: panic_on_warn set ...","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98725","source_modified_at":"2026-10-21T12:56:05.735Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"ef4dfad231a787aded76e5b03788ddb18c8aebab","status":"affected","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"9d61131acd742cf97ee64e453383e41b46568513","status":"affected","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4","status":"affected","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"8a9b4c0eef19c207663c1ee888257307c869ca86","status":"affected","versionType":"git"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"fa6778e030bed9841ddcdf96bc7018da9ac03562","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98725","source_modified_at":"2026-10-21T12:56:05.735Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","status":"unaffected","versionType":"semver"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.56","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.10","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98725","source_modified_at":"2026-10-21T12:56:05.735Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"9d61131acd742cf97ee64e453383e41b46568513","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98725","source_modified_at":"2026-10-21T12:56:05.735Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98725","source_modified_at":"2026-10-21T12:56:05.735Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"8a9b4c0eef19c207663c1ee888257307c869ca86","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.002,"percentile":0.09309,"score_date":"2026-10-23"},"published_at":"2026-10-18T15:47:02.735Z","modified_at":"2026-10-21T12:56:05.735Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98725","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T12:56:05.735Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98725","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/ef4dfad231a787aded76e5b03788ddb18c8aebab"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/9d61131acd742cf97ee64e453383e41b46568513"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8a9b4c0eef19c207663c1ee888257307c869ca86"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/fa6778e030bed9841ddcdf96bc7018da9ac03562"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T12:56:05.735Z","content_hash":"263a5e80c9ae58dcf4e94d4ea8b69b01403b5a2ba835c2ccee615662c405ce65"}}