A critical heap out-of-bounds read vulnerability in the Linux kernel nvmet subsystem permits unauthenticated remote attackers to compromise system memory or cause a denial of service.

This vulnerability exists in the nvmet_auth_negotiate function, which fails to validate the transfer length of DH-HMAC-CHAP authentication messages. An unauthenticated attacker can supply crafted messages with excessive hash or DH group identifier counts, forcing the kernel to perform out-of-bounds reads into heap memory.

The vulnerability carries a CVSS score of 9.1, indicating a critical severity level due to the lack of required authentication and the potential for significant impact. Successful exploitation could lead to the exposure of sensitive kernel memory contents or cause the system to crash, resulting in operational downtime for affected storage infrastructure.

Immediate Action: Update the Linux kernel to version 6.6.157, 6.12.110, 6.18.52, 7.2.6, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or abnormal behavior in the NVMe target subsystem, which may indicate attempted exploitation.

Compensating Controls: Restrict network access to NVMe-over-Fabrics targets to trusted management segments only, thereby reducing the exposure of the vulnerable interface to potentially malicious hosts.

Public Exploit Available: Unknown

Given the critical nature of this kernel-level vulnerability and the ease of access to the nvmet interface, immediate patching is required to prevent remote memory disclosure and denial of service. Administrators should verify their kernel version and apply the appropriate security updates provided by their Linux distribution maintainers as soon as possible.