In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()… (CVE-2026-98725)

The Linux kernel's nvmet-auth module had a vulnerability (CVE-2026-98725) where nvmet_auth_challenge() received its output buffer as a void pointer, causing sizeof(*d) to evaluate to one under GCC. This led to undercounting the fixed challenge header size by 15 bytes, allowing a short AUTH_RECEIVE buffer to pass size checks and enabling an out-of-bounds write past the allocated buffer. The bug triggered kernel slab-out-of-bounds errors detected by KASAN and could cause kernel panic. The fix involved using the typed challenge pointer to correctly calculate the response size and prevent memory corruption.

This vulnerability can cause out-of-bounds memory writes in the kernel, leading to memory corruption and potential kernel panic. Such faults can destabilize the system and may be exploitable to affect kernel integrity, though no known exploits are reported. The impact is primarily on system stability and security of the kernel's NVMe target authentication functionality.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the buffer size calculation in nvmet_auth_challenge(). Users should apply the official kernel updates containing this fix when available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor's advisory for current remediation guidance.