CVE-2026-89975: nvme-fabrics: fix DHCHAP secret leak on parse failure

CVE-2026-89975: nvme-fabrics: fix DHCHAP secret leak on parse failure

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nvme-fabrics: fix DHCHAP secret leak on parse failure

nvmf_parse_options() duplicates dhchap_secret and dhchap_ctrl_secret
with match_strdup() before validating the DHHC-1: representation.

If validation fails, the parser returns -EINVAL before the temporary
string in p is assigned to opts->dhchap_secret or
opts->dhchap_ctrl_secret. nvmf_create_ctrl() subsequently frees opts,
but nvmf_free_options() cannot release the unassigned temporary string.
Each rejected option therefore leaks one allocation.

This is easy to miss because valid secrets transfer ownership to opts
and are freed normally, while the malformed-secret path still returns
the expected -EINVAL to userspace.

With CONFIG_NVME_HOST_AUTH enabled, the leak is reachable before the
required-option checks and transport lookup. No NVMe-oF target or
working transport connection is required; for example, repeatedly
writing

	dhchap_secret=BAD

or

	dhchap_ctrl_secret=BAD

to /dev/nvme-fabrics deterministically takes the leaking parse path.

Free the temporary string before leaving both validation error paths.
Use kfree_sensitive() because the copied option may contain secret
material even when its representation is rejected, matching the
sensitive cleanup used for stored DHCHAP secrets.

The Linux kernel CVE team has assigned CVE-2026-89975 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.0 with commit f50fff73d620cd6e8f48bc58d4f1c944615a3fea and fixed in 6.12.110 with commit 702c1ae0d31b44828ec3c87079def490c1ee1fb3
	Issue introduced in 6.0 with commit f50fff73d620cd6e8f48bc58d4f1c944615a3fea and fixed in 6.18.51 with commit 15d7a35a489287109b5a7c157d53d9b8214f0318
	Issue introduced in 6.0 with commit f50fff73d620cd6e8f48bc58d4f1c944615a3fea and fixed in 7.2.5 with commit d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549
	Issue introduced in 6.0 with commit f50fff73d620cd6e8f48bc58d4f1c944615a3fea and fixed in 7.3-rc2 with commit afdee49a1b88ed9bb44e2b30e855297c169bcc53

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89975
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/nvme/host/fabrics.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/702c1ae0d31b44828ec3c87079def490c1ee1fb3
	https://git.kernel.org/stable/c/15d7a35a489287109b5a7c157d53d9b8214f0318
	https://git.kernel.org/stable/c/d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549
	https://git.kernel.org/stable/c/afdee49a1b88ed9bb44e2b30e855297c169bcc53