The vulnerability resides in the nvmet_auth_reply function, where the hw field lengths hl and dhvlen, controlled by an attacker, are not checked against the transfer length tl before being used to index a variable‑length buffer. This omission enables an out‑of‑bounds read of up to 526 bytes beyond the allocated buffer. The read occurs while processing a DHCHAP_REPLY message, meaning an attacker can send a specially crafted packet over an NVMe‑oF connection. The exposed data could include kernel memory contents, leading to information disclosure or a crash and, in some configurations, a starting point for further exploitation such as code execution or privilege escalation.

Affected systems The flaw exists in all Linux kernel versions that use the older nvmet_auth_reply implementation before the included patch (commits 3a413e… and related commits). While no specific version list is supplied, any kernel derived from Linux that incorporates nvmet‑auth without the bounds check is vulnerable, regardless of distribution.

The EPSS score is below 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not yet listed in CISA’s KEV catalog. Nonetheless, because the attack vector requires an NVMe‑oF initiator to send a crafted authentication message, trusted environments with unrestricted NVMe connections are at greater risk. The lack of authentication at the point of read further heightens the potential impact, as the attacker can trigger information disclosure or a kernel fault before any authentication has occurred. Overall, the CVSS severity is high, but the low EPSS suggests that mitigation is still recommended to prevent future or more targeted attacks.