CVE-2026-64319: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64319 Overview

CVE-2026-64319 is an out-of-bounds read vulnerability in the Linux kernel's NVMe-over-Fabrics (NVMe-oF) target authentication subsystem. The flaw resides in nvmet_auth_reply(), which processes DHCHAP_REPLY messages from remote initiators. The function accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (Diffie-Hellman value length) fields without validating them against the allocated transfer length tl. A malicious NVMe-oF initiator can trigger heap reads up to 526 bytes past the buffer boundary. The condition is reachable pre-authentication, making any Linux system exposing an NVMe-oF target vulnerable to remote exploitation.

Critical Impact
Unauthenticated remote attackers can trigger out-of-bounds heap reads in kernel memory, potentially leaking sensitive kernel data or crashing the target host.

Affected Products

Linux kernel versions containing the vulnerable nvmet-auth implementation prior to the fixing commits
Systems configured as NVMe-over-Fabrics targets with DHCHAP authentication
Storage appliances and servers exposing NVMe-oF endpoints over the network

Discovery Timeline

Vulnerability discovered by Atuin — Automated Vulnerability Discovery Engine
2026-07-25 - CVE-2026-64319 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64319

Vulnerability Analysis

The vulnerability affects the NVMe-oF target driver (nvmet) authentication path that implements the DH-HMAC-CHAP (DHCHAP) protocol. When a remote initiator sends a DHCHAP_REPLY message, the target parses fields declaring the hash length (hl) and Diffie-Hellman value length (dhvlen). These lengths determine offsets into the variable-length rval[] payload array.

The function fails to validate that sizeof(*data) + 2*hl + dhvlen fits within the transfer length tl before dereferencing offsets in rval[]. An attacker who crafts a reply with a small tl but large hl/dhvlen values causes the parser to read beyond the allocated heap buffer. When Diffie-Hellman authentication is configured, the out-of-bounds pointer is passed directly to sg_init_one() and consumed by crypto_kpp_compute_shared_secret(), reaching up to 526 bytes past the buffer.

Root Cause

The root cause is missing bounds validation on attacker-controlled length fields before pointer arithmetic on a variable-length array. The parser trusts client-supplied length values without cross-checking them against the allocated transfer length. This is a classic Out-of-Bounds Read (OOB) defect in kernel-mode protocol parsing.

Attack Vector

Exploitation requires network reachability to an NVMe-oF target port and does not require prior authentication. The attacker acts as a rogue NVMe-oF initiator and issues a DHCHAP_REPLY PDU with mismatched length fields. The malformed message triggers out-of-bounds heap reads during host response comparison via memcmp or during shared-secret computation. Consequences include leakage of adjacent kernel heap data through side-channel response timing or authentication behavior, and potential kernel crashes leading to denial of service.

See the upstream fixing commits for the exact patch, including Linux Kernel Commit 3a413ece and Linux Kernel Commit caa71b3a.

Detection Methods for CVE-2026-64319

Indicators of Compromise

Unexpected connections to NVMe-oF target ports (default TCP 4420) from unauthorized initiators
Kernel oops or panic messages referencing nvmet_auth_reply, sg_init_one, or crypto_kpp_compute_shared_secret
Authentication failures from unknown NVMe Qualified Names (NQNs) in the target host logs
Anomalous DHCHAP handshake traffic with inconsistent length fields relative to PDU size

Detection Strategies

Enable kernel address sanitizer (KASAN) on test systems to surface out-of-bounds reads in drivers/nvme/target/auth.c
Deploy network intrusion detection signatures that flag NVMe-oF DHCHAP_REPLY PDUs where declared hl/dhvlen exceed the transfer length
Correlate kernel log events with source IP addresses connecting to NVMe-oF service ports

Monitoring Recommendations

Ingest kernel ring buffer (dmesg) and audit logs into a centralized SIEM for anomaly correlation
Monitor authentication attempt volume and failure ratios on NVMe-oF targets
Alert on any new initiator NQN attempting DHCHAP handshakes outside approved storage clients

How to Mitigate CVE-2026-64319

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fixing commits as soon as vendor builds become available
Restrict network access to NVMe-oF target ports using firewall rules that permit only authorized initiator hosts
Audit systems for the presence of the nvmet kernel module and disable it where NVMe-oF export is not required

Patch Information

The fix adds bounds validation ensuring sizeof(*data) + 2*hl + dhvlen <= tl before any access to the variable-length fields. Patches are available in the following stable tree commits: 3a413ece, 6d7649c1, 80cd28b5, 999f6205, and caa71b3a. Apply the patch matching your kernel branch and rebuild or install the vendor-provided update.

Workarounds

Unload the nvmet module on hosts that do not need to serve NVMe-oF: modprobe -r nvmet_tcp nvmet_rdma nvmet
Place NVMe-oF targets on a segregated storage network isolated from general-purpose or untrusted networks
Enforce IP allow-lists at the host firewall for TCP 4420 and RDMA transport ports used by NVMe-oF

bash

# Configuration example: block NVMe-oF TCP port from untrusted sources
sudo iptables -A INPUT -p tcp --dport 4420 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 4420 -j DROP

# Remove nvmet modules if NVMe-oF target functionality is not required
sudo modprobe -r nvmet_tcp nvmet_rdma nvmet