CVE-2026-64319
A vulnerability in the Linux kernel's NVMe-over-Fabrics (NVMe-oF) authentication module allows for out-of-bounds memory access. This occurs when the system fails to properly validate the size of incoming authentication messages against the allocated memory buffer.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running a Linux kernel that utilizes NVMe-over-Fabrics (NVMe-oF) with DHCHAP authentication configured.
Real-world impact
An attacker could send a specially crafted authentication message to a target system to trigger out-of-bounds memory reads. This could allow them to access sensitive information from the system's memory before any authentication has taken place.
Why this severity
This is rated as critical because it is remotely exploitable without authentication and can lead to significant information disclosure through memory corruption.
What to do about it
- 01Apply the fix to the Linux kernel that validates reply message payload bounds against the transfer length.
NVD-referenced vendor advisory
Timeline
- Jul 25, 2026 · 7d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.