CVE-2026-64319

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the nvmet auth reply() function where the variable-length rval[] array is accessed using attacker-controlled hl (hash length) and dhvlen (DH value length) fields without verifying if they fit within the allocated buffer of tl bytes. A malicious NVMe-oF initiator can craft a DHCHAP REPLY message with a small transfer length but large hl or dhvlen values, leading to out-of-bounds heap reads when the target processes the DH public key or performs the host response memcmp(). This can be exploited pre-authentication, where the out-of-bounds pointer is passed to sg init one() and read by crypto kpp compute shared secret(), potentially accessing up to 526 bytes beyond the buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.