{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()  nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes.  A short AUTH_RECEIVE buffer can pass the check before the challenge is copied past the end of its allocation.  Use the typed challenge pointer when calculating the response size.    BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)   Write of size 32 by task kworker/1:1H/64   Workqueue: nvmet_tcp_wq nvmet_tcp_io_work   Call Trace:   nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)   nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)   nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)   process_one_work (kernel/workqueue.c:3322)   worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)   kthread (kernel/kthread.c:436)   ret_from_fork (arch/x86/kernel/process.c:158)   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)   The buggy address is located 16 bytes inside of    allocated 33-byte region [ffff888000554e80, ffff888000554ea1)   Kernel panic - not syncing: KASAN: panic_on_warn set ...",
  "id": "DEBIAN-CVE-2026-98725",
  "modified": "2026-10-19T04:47:34.977868098Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98725"
    }
  ],
  "upstream": [
    "CVE-2026-98725"
  ]
}