CVE-2026-98726
Received Received - Intake

Buffer Underflow in Linux Kernel NVMe Multipath

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups and namespace IDs to parse. Both bounds checks subtract an untrusted object size from ana_log_size before comparing the current offset. If the object is larger than the buffer, the size_t subtraction underflows and lets the parser read beyond ana_log_buf. Check the current offset before the first subtraction and compare each object size with the remaining buffer instead. This rejects inconsistent ANA data before dereferencing a truncated group descriptor or walking an oversized namespace ID array.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98726
EUVD
EUVD-2026-103811

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba
Linux Linux 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba
Linux Linux 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba
Linux Linux 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba
Linux Linux 4.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a bounds check issue in the nvme-multipath driver. The problem occurs when parsing ANA (Asymmetric Namespace Access) log data. The code incorrectly calculates buffer sizes, leading to an underflow that allows reading beyond the allocated memory buffer. This happens because the number of ANA groups and namespace IDs are parsed independently, and the bounds checks subtract untrusted sizes from the buffer size, causing underflow if the object is larger than the buffer.

Detection Guidance

This vulnerability affects the Linux kernel's NVMe multipath driver. Detection requires checking kernel versions and NVMe driver configurations. Use uname -r to check the kernel version and grep for nvme in lsmod to verify if the driver is loaded. If the kernel is vulnerable, update it immediately.

Impact Analysis

This vulnerability could allow an attacker to read or corrupt kernel memory, potentially leading to system crashes, privilege escalation, or unauthorized data access. Systems using the affected Linux kernel versions with NVMe multipath enabled are at risk if malicious ANA log data is processed.

Mitigation Strategies

Apply the latest kernel updates to patch the NVMe multipath driver. Disable NVMe multipath if not needed. Monitor vendor advisories for patches. Restrict access to NVMe devices if exposed to untrusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98726. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart