---
id: CVE-2026-64319
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvmet-auth: validate reply message payload bounds against transfer length

  nvmet_auth_reply() accesses the variable-length rval[] array using
  attacker-controlled hl (ha…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvmet-auth: validate reply message payload bounds against transfer length

  nvmet_auth_reply() accesses the variable-length rval[] array using
  attacker-controlled hl (ha…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
published: '2026-07-25'
updated: '2026-07-27'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64319'
references:
  - url: 'https://git.kernel.org/stable/c/3a413ece2504c70aa34a20be4dafec04e8c741f9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6d7649c1231dac14d906985d2936967e23041c26'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/999f6205ede984a786f35f727b01f971b98e215d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/caa71b3a43ea5c13fe7141cb019ebcb03b8ac857'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64319.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64319'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507096'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64319'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64319'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026072511-CVE-2026-64319-0860@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:64808'
  - url: 'https://access.redhat.com/errata/RHSA-2026:64775'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00524
epssPercentile: 0.42023
ingestedAt: '2026-07-27T06:16:50.478Z'
vendor: Red Hat
product: Red Hat Enterprise Linux BaseOS (v. 9)
affected:
  - enterprise_linux 10
  - enterprise_linux 9
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_9
  - enterprise_linux_codeready_linux_builder_v_9
  - enterprise_linux_real_time_for_nfv_v_9
  - enterprise_linux_real_time_v_9
patched:
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_9
  - enterprise_linux_codeready_linux_builder_v_9
  - enterprise_linux_real_time_for_nfv_v_9
  - enterprise_linux_real_time_v_9
cwe:
  - CWE-125
scores:
  nvd: 9.1
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: validate reply message payload bounds against transfer length

nvmet_auth_reply() accesses the variable-length rval[] array using
attacker-controlled hl (hash length) and dhvlen (DH value length) fields
without verifying they fit within the allocated buffer of tl bytes.

A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a
small transfer length but large hl/dhvlen values, causing out-of-bounds
heap reads when the target processes the DH public key (rval + 2*hl) or
performs the host response memcmp.

With DH authentication configured, the OOB pointer is passed directly to
sg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching
up to 526 bytes past the buffer. This is exploitable pre-authentication.

Add bounds validation ensuring sizeof(*data) + 2*hl + dhvlen <= tl before
any access to the variable-length fields.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:64808** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64808)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64319.json)
- **RHSA-2026:64775** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64775)