CVE-2026-98725
Description
A flaw was found in the Linux kernel's NVMe over Fabrics (NVMe-oF) target authentication component. A remote attacker connecting to the NVMe target service can exploit this vulnerability by sending a crafted authentication request, causing a Denial of Service (DoS) through a system crash or potential memory corruption. This issue occurs due to an incorrect buffer size calculation during authentication challenge processing, which allows an undersized buffer to bypass validation checks and results in an out-of-bounds write.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker on the network can trigger a kernel panic or corrupt kernel memory, resulting in a system-wide denial of service. In typical Red Hat Enterprise Linux deployments, NVMe over Fabrics target mode is not enabled by default and requires explicit administrator configuration to export storage and process authentication. Only systems specifically configured to operate as NVMe-oF targets with in-band authentication are exposed to this issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
