CVE-2026-64319 nvmet-auth: validate reply message payload bounds against transfer length
A malicious NVMe-oF initiator can trigger out-of-bounds heap reads in the Linux kernel's nvmet-auth module, potentially leaking memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64319?
CVE-2026-64319 is a critical memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: validate reply message payload bounds against transfer length
nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (DH value length) fields without verifying they fit within the allocated buffer of tl bytes.
A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a small transfer length but large hl/dhvlen values, causing out-of-bounds heap reads when the target processes the DH public key (rval + 2*hl) or performs the host response memcmp.
With DH authentication configured, the OOB pointer is passed directly to sg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching up to 526 bytes past the buffer. This is exploitable pre-authentication.
Add bounds validation ensuring sizeof(*data) + 2*hl + dhvlen <= tl before any access to the variable-length fields.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Weakness: CWE-125
Which versions are affected by CVE-2026-64319?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64319?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64319 being exploited?
There is no known exploitation of CVE-2026-64319 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64319, DEBIAN-CVE-2026-64319, GHSA-78p6-7rph-cp36, ROOT-OS-DEBIAN-12-CVE-2026-64319, ROOT-OS-UBUNTU-2204-CVE-2026-64319, UBUNTU-CVE-2026-64319.