nvmet: pre-auth heap OOB read in DH-HMAC-CHAP authentication (data->hl unchecked in nvmet_auth_reply)

[Greg KH]

On Mon, Jun 01, 2026 at 08:32:37PM -0700, Jeremy Erazo wrote:
> == Disclosure preferences ==
> 
> I'm happy with any reasonable embargo length (14-30 days). I have
> not shared this finding with any third party. Please coordinate CVE
> assignment with the kernel.org CNA.

You sent this to a public mailing list, there is no "embargo" possible.
Nor is this how CVEs are assigned (please read the documentation for
that.)

Please submit a patch for both of the issues you reported, in a format
that can be applied, so this can be resolved properly.

thanks,

greg k-h