CVE-2026-64319

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmet-auth: validate reply message payload bounds against transfer length<br /> <br /> nvmet_auth_reply() accesses the variable-length rval[] array using<br /> attacker-controlled hl (hash length) and dhvlen (DH value length) fields<br /> without verifying they fit within the allocated buffer of tl bytes.<br /> <br /> A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a<br /> small transfer length but large hl/dhvlen values, causing out-of-bounds<br /> heap reads when the target processes the DH public key (rval + 2*hl) or<br /> performs the host response memcmp.<br /> <br /> With DH authentication configured, the OOB pointer is passed directly to<br /> sg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching<br /> up to 526 bytes past the buffer. This is exploitable pre-authentication.<br /> <br /> Add bounds validation ensuring sizeof(*data) + 2*hl + dhvlen