CVE-2026-64320

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

nvmet_execute_disc_get_log_page() validates only the dword alignment

of the host-supplied Log Page Offset (lpo). The 64-bit offset is then

added to a small kzalloc'd buffer that holds the discovery log page

and the result is passed straight to nvmet_copy_to_sgl(), which

memcpy()s data_len bytes out to the host with no source-side bound

check:

u64 offset = nvmet_get_log_page_offset(req->cmd); /* 64-bit host */

size_t data_len = nvmet_get_log_page_len(req->cmd); /* 32-bit host */

...

if (offset & 0x3) { ... } /* only check */

...

alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);

buffer = kzalloc(alloc_len, GFP_KERNEL);

...

status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);

The Discovery controller is unauthenticated -- nvmet_host_allowed()

ret

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References