Linux Kernel EUVD-2026-58888

Exploitation requires that the target host is running as an NVMe-oF target (nvmet) AND that in-band DH-HMAC-CHAP authentication is explicitly configured/enabled on that target - this is the concrete gating condition stated in the description ('reachable only when in-band DH-HMAC-CHAP authentication is configured on the target') and is not the default. Given that condition, the attacker needs network reachability to the NVMe-oF fabric as an initiator and can trigger the bug during the authentication handshake without prior valid credentials, by supplying an AUTH_RECEIVE allocation length shorter than the required response (as small as one byte) in the SUCCESS1 or FAILURE1/default state. The limiting factors that reduce real-world risk are: NVMe-oF target deployment is itself specialized, in-band authentication is an opt-in configuration, and the CHALLENGE state is not affected because it retains its existing variable-length guard.

The upstream CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects a remote, low-complexity, unauthenticated network vector, but that headline number materially overstates real-world exposure because the vulnerable code is reachable only when a target explicitly enables in-band DH-HMAC-CHAP authentication on NVMe-oF - a non-default, comparatively uncommon storage-fabric configuration not captured by base CVSS. The demonstrated primitive is a bounded 16-byte heap out-of-bounds write, which most plausibly yields kernel memory corruption and denial of service (panic), with code execution requiring additional heap-grooming effort rather than being guaranteed. Corroborating signals point the same way: EPSS is low at 0.25% (17th percentile), the CVE is not listed in CISA KEV, and no public proof-of-concept is identified, so this is a genuine but not mass-exploited issue. The practical takeaway is that operators running NVMe-oF targets with authentication enabled - even a mid-sized municipal IT team - should patch promptly because such targets front high-value storage and are exposed to any initiator that can reach the fabric, whereas environments without NVMe-oF or without in-band auth are effectively unaffected and can treat this as routine.

An attacker who can reach an NVMe-oF target that has in-band DH-HMAC-CHAP authentication enabled initiates the authentication exchange and sends an AUTH_RECEIVE command advertising a one-byte allocation length. In the SUCCESS1 or FAILURE1 state the target allocates a tiny buffer but writes the full fixed-size DH-HMAC-CHAP response into it, producing a 16-byte heap out-of-bounds write that corrupts adjacent kernel memory and can crash the target or, with additional effort, be shaped toward code execution. No public proof-of-concept is known at time of analysis; the low attack complexity means a working exploit is feasible for a capable attacker on the fabric.