CVE-2026-89975 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
nvme-fabrics: fix DHCHAP secret leak on parse failure
nvmf_parse_options() duplicates dhchap_secret and dhchap_ctrl_secret with match_strdup() before validating the DHHC-1: representation.
If validation fails, the parser returns -EINVAL before the temporary string in p is assigned to opts->dhchap_secret or opts->dhchap_ctrl_secret. nvmf_create_ctrl() subsequently frees opts, but nvmf_free_options() cannot release the unassigned temporary string. Each rejected option therefore leaks one allocation.
This is easy to miss because valid secrets transfer ownership to opts and are freed normally, while the malformed-secret path still returns the expected -EINVAL to userspace.
With CONFIG_NVME_HOST_AUTH enabled, the leak is reachable before the required-option checks and transport lookup. No NVMe-oF target or working transport connection is required; for example, repeatedly writing
dhchap_secret=BAD
or
dhchap_ctrl_secret=BAD
to /dev/nvme-fabrics deterministically takes the leaking parse path.
Free the temporary string before leaving both validation error paths. Use kfree_sensitive() because the copied option may contain secret material even when its representation is rejected, matching the sensitive cleanup used for stored DHCHAP secrets.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified in the nvme-fabrics subsystem represents a memory leak resulting from improper resource management during the parsing of authentication credentials. Specifically, the function nvmf_parse_options duplicates strings representing dhchap_secret and dhchap_ctrl_secret using match_strdup before validating their format against DHCHAP-1 standards. When the validation process fails due to malformed input, the parser returns an error code -EINVAL without assigning these temporary string pointers to the persistent options structure opts. Consequently, when nvmf_create_ctrl subsequently frees the opts structure via nvmf_free_options, it cannot release the unassigned temporary strings because they were never transferred into the managed memory block. This logic flaw ensures that every rejected authentication option results in a permanent leak of kernel heap memory.
The operational impact of this vulnerability is significant due to its ease of exploitation and low barrier to entry for attackers. With CONFIG_NVME_HOST_AUTH enabled, the vulnerable code path is reachable before any transport lookup or required-option checks are performed. This means that an attacker does not need access to a valid NVMe-over-Fabrics target or a working network connection to trigger the leak. By repeatedly writing malformed values such as dhchap_secret=BAD or dhchap_ctrl_secret=BAD to the /dev/nvme-fabrics interface, an adversary can deterministically force the kernel into the leaking parse path. This allows for rapid and sustained memory exhaustion attacks against the host system, potentially leading to a denial of service condition by depleting available kernel memory resources over time.
From a technical classification perspective, this issue aligns with CWE-401, which describes missing release of memory after effective usage. The root cause lies in the failure to free dynamically allocated memory when an error path is taken during string parsing operations. In terms of attack vectors and techniques, this vulnerability can be leveraged within the context of ATT&CK technique T1529, System Shutdown or Reboot, if the resulting resource exhaustion causes system instability or crash. Furthermore, it relates to information leakage concepts under CWE-403 due to the handling of sensitive credential material in memory that is not properly sanitized before being leaked, although the primary impact here remains availability rather than confidentiality breach through direct data exfiltration.
The remediation for this vulnerability involves modifying the error handling logic within nvmf_parse_options to explicitly free the temporary string allocations before returning an error code. The fix utilizes kfree_sensitive() instead of standard kfree when releasing these strings. This function is critical because it not only frees the memory but also overwrites the contents with zeros, ensuring that sensitive secret material contained in malformed options does not remain recoverable in kernel memory after the allocation fails. This approach matches the security practices applied to successfully stored DHCHAP secrets and ensures consistent cleanup behavior regardless of whether the input validation passes or fails.