In the Linux kernel, the nvmet module incorrectly processes HMAC-CHAP authentication negotiation messages. The code allocates a buffer based on a host-supplied transfer length but fails to forward that length to the parsing function, and it does not validate the number of hash or DH group identifiers reported by the host. When a host supplies a transfer length smaller than the negotiation structure or values for the number of identifiers larger than the internal array limits, the code indexes past the end of the buffer, resulting in a heap out-of-bounds read. An attacker controlling the host can therefore cause the kernel to read arbitrary memory from the heap, potentially leaking sensitive kernel data. The vulnerability does not directly lead to code execution but can expose confidential information and weaken overall system security.

Linux kernel implementations that expose NVMe‑over‑Fabrics target functionality, particularly versions that have not incorporated the recent patch correcting nvmet_auth_negotiate(). The affected product is the Linux operating system kernel; specific affected versions are all kernels released before the fix was merged.

The CVSS score of 9.1 places this issue in the High‑severity category, indicating serious potential impact. The EPSS score is less than 1 %, suggesting that at the time of this analysis the likelihood of exploitation is low, though the vulnerability remains present. It is not listed in the CISA KEV catalog, but competent adversaries could exploit it via a non‑conformant or malicious NVMe host that initiates a negotiation with oversized identifiers or a truncated transfer length. Because the flaw triggers an information‑disclosure read from the kernel heap, an attacker could gather sensitive data from memory. The attack vector is inferred to be a remote or local host communicating with an NVMe target, as the vulnerable logic resides in the NVMe target's authentication path.