VulnerabilityPublished 16 Sep 2026Updated 21 Oct 2026

CVE-2026-89975: Linux kernel · nvme-fabrics: fix DHCHAP secret leak on parse failure

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 19:55 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549, afdee49a1b88ed9bb44e2b30e855297c169bcc53, 702c1ae0d31b44828ec3c87079def490c1ee1fb3 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 16 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549	Fixed in d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < afdee49a1b88ed9bb44e2b30e855297c169bcc53	Fixed in afdee49a1b88ed9bb44e2b30e855297c169bcc53
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < 702c1ae0d31b44828ec3c87079def490c1ee1fb3	Fixed in 702c1ae0d31b44828ec3c87079def490c1ee1fb3
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < 15d7a35a489287109b5a7c157d53d9b8214f0318	Fixed in 15d7a35a489287109b5a7c157d53d9b8214f0318
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < 3ce0e9b43f355dfa0bdc0e0dd889795752285791	Fixed in 3ce0e9b43f355dfa0bdc0e0dd889795752285791
LinuxLinux	Affected =6.0	Fixed in–

AI-suggested

This vulnerability has been fixed in the Linux kernel after version 6.0 in the commits identified by hashes d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549, afdee49a1b88ed9bb44e2b30e855297c169bcc53, 702c1ae0d31b44828ec3c87079def490c1ee1fb3, 15d7a35a489287109b5a7c157d53d9b8214f0318, and 3ce0e9b43f355dfa0bdc0e0dd889795752285791. Users should update to a fixed kernel version containing these commits. No additional mitigation is required once patched.

Description

A vulnerability in the Linux kernel's nvme-fabrics subsystem causes a memory leak of DHCHAP secret material when parsing malformed secrets. The issue occurs because temporary strings holding secret data are not freed on parse failure, potentially leaking sensitive information. This affects Linux kernel version 6.0 and has been fixed in subsequent commits.

Impact

The vulnerability causes a memory leak of sensitive DHCHAP secret material in kernel memory when malformed secrets are parsed. Although it does not directly allow code execution or privilege escalation, leaking secret material can weaken authentication security. The leak can be triggered deterministically by writing malformed secrets to /dev/nvme-fabrics. There is no evidence of exploitation in the wild.

Summary

The Linux kernel nvme-fabrics component had a flaw in the nvmf_parse_options() function where duplicated DHCHAP secrets (dhchap_secret and dhchap_ctrl_secret) were allocated but not freed if validation failed. Specifically, if the DHHC-1 representation was invalid, the parser returned an error before assigning the temporary string to the options structure, causing a memory leak of secret material. This leak is reachable with CONFIG_NVME_HOST_AUTH enabled and does not require an active NVMe-oF target or transport connection. The fix involves freeing the temporary string with kfree_sensitive() on all error paths to securely release secret data.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 19:55 UTC

Technical details

References

Community reviews

Related threats