CVE-2026-80791: Linux

EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTH_RECEIVE response buffer nvmet_execute_auth_receive() allocates the response buffer with kmalloc() sized by the host-supplied AUTH_RECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size message into it. The full allocation length is then copied to the wire by nvmet_copy_to_sgl(), so a remote initiator receives the bytes past the built message -- up to nearly a page of uninitialized slab -- during the pre-authentication handshake. Allocate the buffer with kzalloc() so the unwritten tail is zeroed before it is sent; conforming responses are unaffected.

Affected products

• Linux Linux: from 6.0, before 6.1.185 (fixed in 6.1.185); from 6.2, before 6.6.154 (fixed in 6.6.154); from 6.7, before 6.12.106 (fixed in 6.12.106); from 6.13, before 6.18.47 (fixed in 6.18.47); from 6.19, before 7.1.11 (fixed in 7.1.11); from 7.2, before 7.2.1 (fixed in 7.2.1)

Published 2026-09-04. Last modified 2026-09-04.