CVE-2026-64319

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: validate reply message payload bounds against transfer length

nvmet_auth_reply() accesses the variable-length rval[] array using

attacker-controlled hl (hash length) and dhvlen (DH value length) fields

without verifying they fit within the allocated buffer of tl bytes.

A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a

small transfer length but large hl/dhvlen values, causing out-of-bounds

heap reads when the target processes the DH public key (rval + 2*hl) or

performs the host response memcmp.

With DH authentication configured, the OOB pointer is passed directly to

sg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching

up to 526 bytes past the buffer. This is exploitable pre-authentication.

Add bounds validation ensuring sizeof(*data) + 2*hl + dhvlen <= tl before

any access to the variable-length fields.

Discovered by Atuin - Automated Vulnerability Discovery Engine

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References