AZL-99606
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99606.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-99606
- Upstream
- Published
- 2026-09-04T16:18:05Z
- Modified
- 2026-09-05T14:15:11.335417346Z
- Summary
- CVE-2026-80791 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: zero the AUTH_RECEIVE response buffer
nvmetexecuteauthreceive() allocates the response buffer with kmalloc() sized by the host-supplied AUTHRECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size message into it. The full allocation length is then copied to the wire by nvmetcopyto_sgl(), so a remote initiator receives the bytes past the built message -- up to nearly a page of uninitialized slab -- during the pre-authentication handshake.
Allocate the buffer with kzalloc() so the unwritten tail is zeroed before it is sent; conforming responses are unaffected.
- References