UBUNTU-CVE-2026-80791

Dashboard / Vulnerabilities / UBUNTU-CVE-2026-80791

UBUNTU-CVE-2026-80791

Summary:

Details: In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTH_RECEIVE response buffer nvmet_execute_auth_receive() allocates the response buffer with kmalloc() sized by the host-supplied AUTH_RECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size message into it. The full allocation length is then copied to the wire by nvmet_copy_to_sgl(), so a remote initiator receives the bytes past the built message -- up to nearly a page of uninitialized slab -- during the pre-authentication handshake. Allocate the buffer with kzalloc() so the unwritten tail is zeroed before it is sent; conforming responses are unaffected.

References: https://ubuntu.com/security/CVE-2026-80791, https://www.cve.org/CVERecord?id=CVE-2026-80791, https://git.kernel.org/linus/3ddcfb013322aa37eaa7a0d344b73079c38dfa21