CVE-2026-90230 Affecting linux-6.12 package, versions <6.12.111-1~deb12u1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIAN12-LINUX612-20506710
- published5 Oct 2026
- disclosed17 Sept 2026
Introduced: 17 Sep 2026
NewCVE-2026-90230 (opens in a new tab)How to fix?
Upgrade Debian:12 linux-6.12 to version 6.12.111-1~deb12u1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream linux-6.12 package and not the linux-6.12 package as distributed by Debian.
See How to fix? for Debian:12 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
nvmet_execute_auth_send() allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length (tl) and hands it to nvmet_auth_negotiate() without passing tl along. nvmet_auth_negotiate() then reads the negotiate header and, for each of the halen hash identifiers and dhlen DH group identifiers, indexes into the fixed idlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).
Neither the transfer length nor halen/dhlen is validated. A malicious or non-conformant host can report a tl smaller than the negotiate structure, or a halen/dhlen larger than the array (both are u8, up to 255), making the loops read past the end of the allocated buffer (heap out-of-bounds read). The sibling nvmet_auth_reply() already validates tl against the structure size; the negotiate path did not.
Pass tl into nvmet_auth_negotiate(), reject a tl that does not cover the negotiate data plus one full protocol descriptor, and reject halen/dhlen larger than NVME_AUTH_DHCHAP_MAX_DH_IDS.
References
- https://security-tracker.debian.org/tracker/CVE-2026-90230
- https://git.kernel.org/stable/c/5bb96cc218835769ab74ec7f3ea2bf81fbffe955
- https://git.kernel.org/stable/c/7b81e4d2230e3d2d372c826180c4ef0efc244f31
- https://git.kernel.org/stable/c/89ff11b72f38976f3b5aea23a5228ee05e277209
- https://git.kernel.org/stable/c/aaac783950b17c57df9b6f7344747cacb1a407ed
- https://git.kernel.org/stable/c/c38a8186326799957d293d370136c128cd113916