CVE-2026-89975 Overview
CVE-2026-89975 is a memory leak vulnerability in the Linux kernel's nvme-fabrics subsystem. The flaw exists in nvmf_parse_options(), which duplicates dhchap_secret and dhchap_ctrl_secret values with match_strdup() before validating the DHHC-1 representation. When validation fails, the function returns -EINVAL without assigning the temporary string to the options structure. The unassigned allocation is never freed, leaking one buffer per rejected option.
Critical Impact
With CONFIG_NVME_HOST_AUTH enabled, local users writing malformed DHCHAP secrets to /dev/nvme-fabrics can deterministically leak kernel memory containing secret material, exhausting resources over time.
Affected Products
- Linux kernel builds with CONFIG_NVME_HOST_AUTH enabled
- NVMe over Fabrics (nvme-fabrics) host driver
- Stable kernel branches receiving the four referenced backports
Discovery Timeline
- 2026-09-16 - CVE-2026-89975 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89975
Vulnerability Analysis
The vulnerability resides in the NVMe over Fabrics option parser inside the Linux kernel. nvmf_parse_options() processes user-supplied option strings written to /dev/nvme-fabrics, including authentication secrets used by DH-HMAC-CHAP. The parser calls match_strdup() to allocate a copy of the secret string in kernel memory, storing the pointer in a local variable p. Only after successful validation of the DHHC-1: representation does the parser assign p to opts->dhchap_secret or opts->dhchap_ctrl_secret, transferring ownership to the options structure.
When the DHHC-1 format check fails, the parser returns -EINVAL before the assignment happens. The caller, nvmf_create_ctrl(), then frees opts through nvmf_free_options(). Because the temporary allocation was never linked to opts, the cleanup path cannot reach it, resulting in a persistent kernel heap leak. The path is reachable before required-option checks and transport lookup execute, so no NVMe-oF target or working transport is required to trigger it.
Root Cause
The root cause is improper ownership transfer between allocation and validation. The pattern allocates a sensitive buffer with match_strdup(), validates its contents, and only then assigns it to the owning structure. Any error path between allocation and assignment must free the buffer explicitly, which the original code omitted for both DHCHAP secret fields.
Attack Vector
A local user with write access to /dev/nvme-fabrics can repeatedly submit option strings such as dhchap_secret=BAD or dhchap_ctrl_secret=BAD. Each rejected write leaks one allocation containing attacker-controlled or partially attacker-controlled data. Sustained abuse causes kernel memory exhaustion, a denial-of-service condition. Because the leaked buffers may contain valid secret material submitted by other callers on shared systems, the fix uses kfree_sensitive() rather than kfree(). See the kernel commit d21da6cc91ba for the corrected error-path handling.
Detection Methods for CVE-2026-89975
Indicators of Compromise
- Repeated write() syscalls to /dev/nvme-fabrics from unprivileged or unexpected processes
- Growth in kernel slab caches (kmalloc-*) that does not correspond to legitimate NVMe-oF connection activity
- dmesg entries showing repeated -EINVAL returns from NVMe fabrics option parsing
Detection Strategies
- Audit access to /dev/nvme-fabrics using Linux Audit (auditctl -w /dev/nvme-fabrics -p wa) and alert on writes from processes outside the expected NVMe management tooling.
- Monitor kernel memory allocator statistics via /proc/slabinfo for abnormal growth in general-purpose kmalloc caches on hosts with NVMe-oF enabled.
- Correlate userspace nvme connect failures with kernel log noise indicating malformed DHCHAP secrets.
Monitoring Recommendations
- Collect kernel logs and audit records into a centralized log platform for longitudinal analysis of /dev/nvme-fabrics interactions.
- Baseline expected NVMe-oF connection attempts per host and alert on volume anomalies.
- Track kernel version and CONFIG_NVME_HOST_AUTH status across the fleet to prioritize patching for exposed hosts.
How to Mitigate CVE-2026-89975
Immediate Actions Required
- Update affected Linux kernels to a stable release containing the four upstream fix commits referenced by this CVE.
- Restrict access to /dev/nvme-fabrics so that only privileged administrative accounts and NVMe management tooling can write to it.
- On hosts that do not require NVMe over Fabrics, disable or blacklist the nvme_fabrics module.
Patch Information
The fix frees the temporary secret buffer before returning from both validation error paths using kfree_sensitive(), matching the sensitive cleanup used elsewhere for stored DHCHAP secrets. Backports are available across stable branches. See the upstream commits: 15d7a35a4892, 702c1ae0d31b, afdee49a1b88, and d21da6cc91ba.
Workarounds
- Rebuild the kernel without CONFIG_NVME_HOST_AUTH if DH-HMAC-CHAP authentication is not required for NVMe-oF connections.
- Enforce strict file permissions on /dev/nvme-fabrics and remove any group or world write bits granted by non-default udev rules.
- Constrain NVMe management tooling to a dedicated administrative account and log all invocations for review.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
