CVE-2026-64320

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page<br /> <br /> nvmet_execute_disc_get_log_page() validates only the dword alignment<br /> of the host-supplied Log Page Offset (lpo). The 64-bit offset is then<br /> added to a small kzalloc&amp;#39;d buffer that holds the discovery log page<br /> and the result is passed straight to nvmet_copy_to_sgl(), which<br /> memcpy()s data_len bytes out to the host with no source-side bound<br /> check:<br /> <br /> u64 offset = nvmet_get_log_page_offset(req-&gt;cmd); /* 64-bit host */<br /> size_t data_len = nvmet_get_log_page_len(req-&gt;cmd); /* 32-bit host */<br /> ...<br /> if (offset &amp; 0x3) { ... } /* only check */<br /> ...<br /> alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);<br /> buffer = kzalloc(alloc_len, GFP_KERNEL);<br /> ...<br /> status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);<br /> <br /> The Discovery controller is unauthenticated -- nvmet_host_allowed()<br /> returns true unconditionally for the discovery subsystem -- so the call<br /> is reachable pre-authentication by any TCP/RDMA/FC peer that can reach<br /> the nvmet target. With a discovery log page of ~1 KiB, an attacker<br /> requesting up to 4 KiB starting at offset == alloc_len reads the next<br /> slab page out and gets its content returned over the fabric (an<br /> empirical run on a default nvmet-tcp loopback target leaked 81<br /> canonical kernel pointers in one Get Log Page response). Pointing the<br /> offset at unmapped kernel memory faults the in-kernel memcpy and<br /> crashes (or panics, on panic_on_oops=1) the target host instead.<br /> <br /> The attacker-controlled source-side offset pattern<br /> "nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)" is unique<br /> to nvmet_execute_disc_get_log_page in the entire nvmet codebase: every<br /> other Get Log Page handler in admin-cmd.c either ignores lpo (and<br /> silently starts every response at offset 0) or tracks a local<br /> destination offset with a fixed source pointer.<br /> <br /> Validate the host-supplied offset against the log page size, cap the<br /> copy length to what is actually available, and zero-fill any remainder<br /> of the host transfer buffer. The zero-fill matches the existing<br /> short-response pattern in nvmet_execute_get_log_changed_ns()<br /> (admin-cmd.c) and prevents leaking transport SGL contents when the<br /> host asks for more bytes than the log page contains.