VulnerabilityPublished 16 Sep 2026Updated 30 Oct 2026

CVE-2026-89975: Linux kernel · nvme-fabrics: fix DHCHAP secret leak on parse failure

Source GCVE Database

Compare

Authoritative record:CVE-2026-89975· Medium

Not known to be exploited · fixed in d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 19:20 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549, afdee49a1b88ed9bb44e2b30e855297c169bcc53, 702c1ae0d31b44828ec3c87079def490c1ee1fb3 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 16 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-9hxp-3v8h-pjp2

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549	Fixed in d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < afdee49a1b88ed9bb44e2b30e855297c169bcc53	Fixed in afdee49a1b88ed9bb44e2b30e855297c169bcc53
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < 702c1ae0d31b44828ec3c87079def490c1ee1fb3	Fixed in 702c1ae0d31b44828ec3c87079def490c1ee1fb3
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < 35ec48228f6739339583e5a73ca315156372e30d	Fixed in 35ec48228f6739339583e5a73ca315156372e30d
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < 15d7a35a489287109b5a7c157d53d9b8214f0318	Fixed in 15d7a35a489287109b5a7c157d53d9b8214f0318
LinuxLinux	Affected ≥ f50fff73d620cd6e8f48bc58d4f1c944615a3fea, < 3ce0e9b43f355dfa0bdc0e0dd889795752285791	Fixed in 3ce0e9b43f355dfa0bdc0e0dd889795752285791

AI-suggested

A fix is available in the Linux kernel that properly frees temporary secret strings on validation failure using kfree_sensitive(). Users should update to a kernel version that includes this fix. Until patched, avoid writing malformed DHCHAP secrets to /dev/nvme-fabrics and restrict local access to this interface to trusted users.

Description

A vulnerability in the Linux kernel's nvme-fabrics subsystem causes a memory leak of DHCHAP secret material when parsing malformed secrets. The issue occurs during validation failure of DHCHAP secrets, where temporary strings containing secret data are not properly freed, leading to a leak of sensitive information. This leak can be triggered by writing malformed secrets to /dev/nvme-fabrics with CONFIG_NVME_HOST_AUTH enabled. The vulnerability does not require an active NVMe-oF target or transport connection to exploit.

Impact

This vulnerability causes a memory leak of sensitive DHCHAP secret material in kernel memory, potentially exposing secret data to unauthorized access. The leak can be triggered locally by writing malformed secrets to the nvme-fabrics interface. Although it does not require an active NVMe-oF target or transport connection, the impact is limited to local users with access to /dev/nvme-fabrics and CONFIG_NVME_HOST_AUTH enabled. There is no indication of remote exploitation or active exploitation in the wild.

References

Community reviews

Loading reviews…