CVE-2026-64320

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds heap read exists in the nvmet execute disc get log page() function. The issue occurs because the function only validates the dword alignment of the host-supplied Log Page Offset lpo without performing a source-side bound check. This 64-bit offset is added to a buffer allocated via kzalloc(), and the result is passed to nvmet copy to sgl(), which uses memcpy() to send data back to the host.

Since the Discovery controller is unauthenticated, this flaw is reachable pre-authentication by any TCP, RDMA, or FC peer. An attacker can exploit this by providing a specific offset to read adjacent slab page contents, potentially leaking kernel pointers, or by pointing the offset to unmapped kernel memory to cause a system crash or kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.