{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-64319 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-64319 is a critical memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64319 and fix it if it is affected.\n\nWhat it is: CVE-2026-64319 is a critical memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64319 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64319/ (Markdown: https://insights.sbomify.com/CVE-2026-64319/index.md)","id":"CVE-2026-64319","markdown":"https://insights.sbomify.com/CVE-2026-64319/index.md","name":"CVE-2026-64319","record":{"aliases":["BELL-CVE-2026-64319","DEBIAN-CVE-2026-64319","GHSA-78p6-7rph-cp36","ROOT-OS-DEBIAN-12-CVE-2026-64319","ROOT-OS-UBUNTU-2204-CVE-2026-64319","UBUNTU-CVE-2026-64319"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read","denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Linux kernel NVMe-oF","requires_auth":"none","summary":"A malicious NVMe-oF initiator can trigger out-of-bounds heap reads in the Linux kernel's nvmet-auth module, potentially leaking memory or causing a crash.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-125","name":"Out-of-bounds Read"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: validate reply message payload bounds against transfer length\n\nnvmet_auth_reply() accesses the variable-length rval[] array using\nattacker-controlled hl (hash length) and dhvlen (DH value length) fields\nwithout verifying they fit within the allocated buffer of tl bytes.\n\nA malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a\nsmall transfer length but large hl/dhvlen values, causing out-of-bounds\nheap reads when the target processes the DH public key (rval + 2*hl) or\nperforms the host response memcmp.\n\nWith DH authentication configured, the OOB pointer is passed directly to\nsg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching\nup to 526 bytes past the buffer. This is exploitable pre-authentication.\n\nAdd bounds validation ensuring sizeof(*data) + 2*hl + dhvlen \u003c= tl before\nany access to the variable-length fields.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"nvmet-auth: validate reply message payload bounds against transfer length","id":"CVE-2026-64319","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page","id":"CVE-2026-64320"},"packages":[],"prev":{"headline":"partitions: aix: bound the pp_count scan to the ppe array","id":"CVE-2026-64318"},"products":["Linux"],"published":"2026-07-25","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A malicious NVMe-oF initiator can trigger out-of-bounds heap reads in the Linux kernel's nvmet-auth module, potentially leaking memory or causing a crash.","url":"https://insights.sbomify.com/CVE-2026-64319/"}