CVE-2026-80791: Linux Kernel Information Disclosure Vulnerability

CVE-2026-80791 Overview

CVE-2026-80791 is an information disclosure vulnerability in the Linux kernel's NVMe-oF target (nvmet) authentication subsystem. The flaw resides in nvmet_execute_auth_receive(), which allocates a response buffer using kmalloc() sized by the host-supplied AUTH_RECEIVE allocation length. The DH-HMAC-CHAP builders write only a fixed-size message into that buffer, leaving the remainder uninitialized. The full allocation is then transmitted to the wire via nvmet_copy_to_sgl(), exposing up to nearly a page of uninitialized slab memory to a remote initiator during the pre-authentication handshake.

Critical Impact
A remote initiator can retrieve uninitialized kernel slab memory from an NVMe-oF target during pre-authentication, potentially leaking sensitive kernel data without valid credentials.

Affected Products

Linux kernel versions containing the nvmet-auth DH-HMAC-CHAP implementation
NVMe over Fabrics (NVMe-oF) target deployments using in-band authentication
Distributions shipping affected kernels prior to the referenced stable commits

Discovery Timeline

2026-09-04 - CVE-2026-80791 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80791

Vulnerability Analysis

The vulnerability is an uninitialized memory disclosure [CWE-908] in the NVMe-oF target authentication path. When a remote host issues an AUTH_RECEIVE command, the target allocates a response buffer whose size is dictated by the host's allocation-length field. The DH-HMAC-CHAP response builders populate only the fixed-size protocol message. The bytes beyond that message retain whatever slab contents were present at allocation time. Because nvmet_copy_to_sgl() transmits the entire allocated length, the untouched tail is delivered to the initiator over the fabric.

This primitive executes during the pre-authentication handshake. An attacker capable of reaching the NVMe-oF target does not need valid credentials to trigger the leak. Repeated AUTH_RECEIVE requests with maximal allocation lengths can harvest kernel slab memory across many allocations.

Root Cause

The root cause is the use of kmalloc() instead of kzalloc() for the AUTH_RECEIVE response buffer in nvmet_execute_auth_receive(). kmalloc() returns memory without zeroing, and the DH-HMAC-CHAP code path never overwrites the tail region between the fixed-size message and the host-supplied allocation length. The fix replaces the allocator with kzalloc(), ensuring the unwritten tail is zeroed before transmission.

Attack Vector

Exploitation requires network reach to an NVMe-oF target that has authentication configured. The attacker connects as an initiator and issues AUTH_RECEIVE commands during the pre-authentication handshake, setting the allocation length to the maximum permitted value. The target responds with the fixed-size DH-HMAC-CHAP message followed by uninitialized slab bytes. See the upstream commit Kernel Git Commit 1d6837d for the reference fix.

Detection Methods for CVE-2026-80791

Indicators of Compromise

Unusually large or repeated AUTH_RECEIVE requests from a single NVMe-oF initiator prior to successful authentication
Initiators requesting maximum allocation lengths in AUTH_RECEIVE commands without completing the DH-HMAC-CHAP handshake
Anomalous connection churn against NVMe-oF target ports (typically TCP 4420 for nvmet-tcp)

Detection Strategies

Inspect kernel version strings against the fixed stable commits listed in the upstream references
Enable NVMe-oF target audit logging where supported and correlate authentication failures with high-volume AUTH_RECEIVE traffic
Deploy network traffic analysis on storage fabric segments to identify oversized authentication responses relative to protocol norms

Monitoring Recommendations

Monitor dmesg and kernel logs for anomalous nvmet authentication events
Track the ratio of AUTH_RECEIVE requests to completed authentications per initiator
Alert on connections to NVMe-oF target ports originating from hosts outside the storage administrative boundary

How to Mitigate CVE-2026-80791

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 1d6837d9, 2dcc9226, 3ddcfb01, 447b668f, 8f6363c8, b26189d2, and dfcf013f from the stable tree
Restrict network access to NVMe-oF target endpoints to trusted storage-network segments only
Inventory hosts running nvmet with in-band authentication and prioritize patching

Patch Information

The fix replaces kmalloc() with kzalloc() in nvmet_execute_auth_receive() so that the response buffer is zeroed before the DH-HMAC-CHAP builders populate the fixed-size message. Conforming responses are unaffected. Vendors have merged the change across multiple stable kernel branches; refer to the Kernel Git Commit 1d6837d, Kernel Git Commit 2dcc9226, and Kernel Git Commit dfcf013f for the applicable backports.

Workarounds

Disable NVMe-oF in-band authentication where operationally acceptable until the kernel is patched
Segment the storage fabric using VLANs or dedicated physical networks to limit initiator reach
Enforce host allow-listing at the transport layer (for example, TCP firewalls) to block untrusted initiators from reaching the target

bash

# Example: restrict NVMe-oF TCP target port to trusted storage subnet
iptables -A INPUT -p tcp --dport 4420 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4420 -j DROP