DEBIAN-CVE-2026-90230

In the Linux kernel, the following vulnerability has been resolved:  nvmet: fix heap out-of-bounds read in nvmetauthnegotiate()  nvmetexecuteauthsend() allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length (tl) and hands it to nvmetauthnegotiate() without passing tl along. nvmetauthnegotiate() then reads the negotiate header and, for each of the halen hash identifiers and dhlen DH group identifiers, indexes into the fixed idlist[60] array (hashes at idlist[0..halen), groups at idlist[30..]).  Neither the transfer length nor halen/dhlen is validated. A malicious or non-conformant host can report a tl smaller than the negotiate structure, or a halen/dhlen larger than the array (both are u8, up to 255), making the loops read past the end of the allocated buffer (heap out-of-bounds read). The sibling nvmetauthreply() already validates tl against the structure size; the negotiate path did not.  Pass tl into nvmetauthnegotiate(), reject a tl that does not cover the negotiate data plus one full protocol descriptor, and reject halen/dhlen larger than NVMEAUTHDHCHAPMAXDHIDS.