{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64319", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.780Z", "datePublished": "2026-07-25T08:49:48.291Z", "dateUpdated": "2026-08-05T12:40:56.826Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:40:56.826Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: validate reply message payload bounds against transfer length\n\nnvmet_auth_reply() accesses the variable-length rval[] array using\nattacker-controlled hl (hash length) and dhvlen (DH value length) fields\nwithout verifying they fit within the allocated buffer of tl bytes.\n\nA malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a\nsmall transfer length but large hl/dhvlen values, causing out-of-bounds\nheap reads when the target processes the DH public key (rval + 2*hl) or\nperforms the host response memcmp.\n\nWith DH authentication configured, the OOB pointer is passed directly to\nsg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching\nup to 526 bytes past the buffer. This is exploitable pre-authentication.\n\nAdd bounds validation ensuring sizeof(*data) + 2*hl + dhvlen <= tl before\nany access to the variable-length fields.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - A remote peer can send the malformed Authentication Send command over NVMe/TCP, which dispatches it through nvmet_req_init() and nvmet_parse_fabrics_admin_cmd() to nvmet_execute_auth_send() and nvmet_auth_reply().\nAC:L - The attacker drives the required Connect, Negotiate, Receive, and Reply sequence and controls the transfer length, hash length, DH length, and transaction ID. No race or condition outside the attacker's control is required.\nPR:N - The allowed Host NQN is an attacker-supplied protocol identifier rather than a credential, and the actual DH-HMAC-CHAP secret is not verified until after the vulnerable read. The path is therefore exploitable pre-authentication.\nUI:N - No victim action is required after the target service and authentication configuration are active; the remote initiator independently completes the protocol sequence.\nS:U - The vulnerable NVMe target code and the affected kernel memory and availability belong to the same host security authority, with no demonstrated VM, IOMMU, or sandbox boundary crossing.\nC:H - The attacker controls a substantial kernel heap over-read through memcmp and the crypto scatterlist/MPI path, with the input pointer reaching hundreds of bytes beyond the allocation and an attacker-selected read length. Adjacent kernel secrets and pointers are therefore at risk.\nI:N - All identified unsafe accesses are reads into correctly sized cryptographic output buffers. No out-of-bounds write, arbitrary modification, or defensible authentication bypass was found.\nA:H - The crypto/MPI over-read can traverse heap-object and page boundaries and fault in kernel context, causing an oops or panic that takes down the storage target or host. An unauthenticated peer can reconnect and trigger it repeatedly."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/target/fabrics-cmd-auth.c"], "versions": [{"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821", "lessThan": "80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0", "status": "affected", "versionType": "git"}, {"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821", "lessThan": "999f6205ede984a786f35f727b01f971b98e215d", "status": "affected", "versionType": "git"}, {"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821", "lessThan": "6d7649c1231dac14d906985d2936967e23041c26", "status": "affected", "versionType": "git"}, {"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821", "lessThan": "caa71b3a43ea5c13fe7141cb019ebcb03b8ac857", "status": "affected", "versionType": "git"}, {"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821", "lessThan": "3a413ece2504c70aa34a20be4dafec04e8c741f9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/target/fabrics-cmd-auth.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0"}, {"url": "https://git.kernel.org/stable/c/999f6205ede984a786f35f727b01f971b98e215d"}, {"url": "https://git.kernel.org/stable/c/6d7649c1231dac14d906985d2936967e23041c26"}, {"url": "https://git.kernel.org/stable/c/caa71b3a43ea5c13fe7141cb019ebcb03b8ac857"}, {"url": "https://git.kernel.org/stable/c/3a413ece2504c70aa34a20be4dafec04e8c741f9"}], "title": "nvmet-auth: validate reply message payload bounds against transfer length", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/target/fabrics-cmd-auth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0", "status": "affected", "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821", "versionType": "git"}, {"lessThan": "999f6205ede984a786f35f727b01f971b98e215d", "status": "affected", "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821", "versionType": "git"}, {"lessThan": "6d7649c1231dac14d906985d2936967e23041c26", "status": "affected", "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821", "versionType": "git"}, {"lessThan": "caa71b3a43ea5c13fe7141cb019ebcb03b8ac857", "status": "affected", "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821", "versionType": "git"}, {"lessThan": "3a413ece2504c70aa34a20be4dafec04e8c741f9", "status": "affected", "version": "db1312dd95488b5e6ff362ff66fcf953a46b1821", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/target/fabrics-cmd-auth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: validate reply message payload bounds against transfer length\n\nnvmet_auth_reply() accesses the variable-length rval[] array using\nattacker-controlled hl (hash length) and dhvlen (DH value length) fields\nwithout verifying they fit within the allocated buffer of tl bytes.\n\nA malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a\nsmall transfer length but large hl/dhvlen values, causing out-of-bounds\nheap reads when the target processes the DH public key (rval + 2*hl) or\nperforms the host response memcmp.\n\nWith DH authentication configured, the OOB pointer is passed directly to\nsg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching\nup to 526 bytes past the buffer. This is exploitable pre-authentication.\n\nAdd bounds validation ensuring sizeof(*data) + 2*hl + dhvlen <= tl before\nany access to the variable-length fields.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."}], "id": "CVE-2026-64319", "lastModified": "2026-08-11T15:00:57.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-25T10:17:13.290", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3a413ece2504c70aa34a20be4dafec04e8c741f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6d7649c1231dac14d906985d2936967e23041c26"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/999f6205ede984a786f35f727b01f971b98e215d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/caa71b3a43ea5c13fe7141cb019ebcb03b8ac857"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: nvmet-auth: validate reply message payload bounds against transfer length", "id": "2507096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507096"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's nvmet-auth component. A remote attacker, by sending a specially crafted NVMe-oF (NVMe over Fabrics) authentication reply message, can cause an out-of-bounds read in the kernel's memory. This vulnerability, exploitable pre-authentication, can lead to the disclosure of sensitive information and potentially a denial of service (DoS) on the affected system."], "name": "CVE-2026-64319", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64319\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64319\nhttps://lore.kernel.org/linux-cve-announce/2026072511-CVE-2026-64319-0860@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db1312dd95488b5e6ff362ff66fcf953a46b1821,80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db1312dd95488b5e6ff362ff66fcf953a46b1821,999f6205ede984a786f35f727b01f971b98e215d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db1312dd95488b5e6ff362ff66fcf953a46b1821,6d7649c1231dac14d906985d2936967e23041c26)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db1312dd95488b5e6ff362ff66fcf953a46b1821,caa71b3a43ea5c13fe7141cb019ebcb03b8ac857)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db1312dd95488b5e6ff362ff66fcf953a46b1821,3a413ece2504c70aa34a20be4dafec04e8c741f9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T13:00:05.594741+00:00", "updated": "2026-08-05T01:00:07.185026+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}