CVE-2026-64319
Received Received - Intake

Heap Out-of-Bounds Read in Linux Kernel NVMe-oF Auth

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (DH value length) fields without verifying they fit within the allocated buffer of tl bytes. A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a small transfer length but large hl/dhvlen values, causing out-of-bounds heap reads when the target processes the DH public key (rval + 2*hl) or performs the host response memcmp. With DH authentication configured, the OOB pointer is passed directly to sg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching up to 526 bytes past the buffer. This is exploitable pre-authentication. Add bounds validation ensuring sizeof(*data) + 2*hl + dhvlen <= tl before any access to the variable-length fields. Discovered by Atuin - Automated Vulnerability Discovery Engine.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64319
EUVD
EUVD-2026-49031

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap out-of-bounds read vulnerability in the Linux kernel's NVMe over Fabrics (NVMe-oF) target implementation. It occurs in the nvmet_auth_reply() function where attacker-controlled hash length (hl) and DH value length (dhvlen) fields are used to access a variable-length array without checking if they fit within the allocated buffer size (tl). This allows a malicious NVMe-oF initiator to craft a message causing the target to read up to 526 bytes past the buffer during DH authentication.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe-oF target implementation. Detection requires checking kernel version and NVMe-oF configuration. Use 'uname -a' to check kernel version and 'dmesg | grep nvmet' to verify if NVMe-oF target is enabled. If DH authentication is configured, inspect kernel logs for authentication-related errors.

Impact Analysis

If you use NVMe over Fabrics with DH authentication enabled in your Linux kernel, an attacker on the same network could exploit this to read sensitive kernel memory. This could lead to information disclosure, potential privilege escalation, or system crashes. The attack is pre-authentication, meaning it doesn't require valid credentials.

Mitigation Strategies

Upgrade to a patched Linux kernel version that includes the fix for CVE-2026-64319. Disable NVMe-oF target with DH authentication if not required. Monitor vendor advisories for kernel updates and apply them promptly. Restrict network access to NVMe-oF targets to trusted initiators only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64319. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart