A flaw in the Linux kernel’s NVMe‑over‑Fabric authentication routine allows a remote initiator to send an AUTH_RECEIVE command whose allocation length is smaller than the size expected by the state machine. The code only verifies that the length is non‑zero and matches the transfer length, then writes the authentication response into a kmalloc buffer without ensuring it is large enough. This results in a 16‑byte heap out‑of-bounds write that corrupts kernel memory. The vulnerability can cause kernel crashes or, if an attacker controls the data written, lead to remote code execution. The outage or crash is triggered when the kernel reaches the fixed‑size DH‑HMAC‑CHAP response builders for the SUCCESS1 and FAILURE1 states.

All Linux kernel releases that provide NVMe‑over‑Fabric support with DH‑HMAC‑CHAP authentication enabled and that have not incorporated the buffer‑length validation change are affected. In practice this includes any mainline kernel built with the nvmet_auth_* code prior to the remediation. Kernels that do not enable NVMe‑over‑Fabric, that run without the authentication subsystems, or that have been patched to reject short AUTH_RECEIVE buffers are not impacted. Kernels that do not serve NVMe‑over‑Fabric traffic to untrusted initiators or that have disabled authentication are also not impacted.

The flaw is remotely exploitable over the network by a well‑positioned NVMe‑oF initiator capable of issuing crafted AUTH_RECEIVE commands. EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, indicating that no large‑scale exploitation has been observed to date. Given the CVSS score of 9.8, the kernel‑space heap overflow is highly critical: it corrupts critical memory structures and can trigger system crashes or privilege escalation. In tightly controlled environments with trusted initiators the risk is lower, but in any scenario where the target is exposed to untrusted networks the potential for a severe denial‑of‑service or remote code execution event remains substantial. Thus, the vulnerability’s risk merits a high severity rating and immediate attention.