CVE-2026-64320nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-bit offset is then added to a small kzalloc'd buffer that holds the discovery log page and the result is passed straight to nvmet_copy_to_sgl(), which memcpy()s data_len bytes out to the host with no source-side bound check: u64 offset = nvmet_get_log_page_offset(req->cmd); /* 64-bit host */ size_t data_len = nvmet_get_log_page_len(req->cmd); /* 32-bit host */ ... if (offset & 0x3) { ... } /* only check */ ... alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req); buffer = kzalloc(alloc_len, GFP_KERNEL); ... status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len); The Discovery controller is unauthenticated -- nvmet_host_allowed() returns true unconditionally for the discovery subsystem -- so the call is reachable pre-authentication by any TCP/RDMA/FC peer that can reach the nvmet target. With a discovery log page of ~1 KiB, an attacker requesting up to 4 KiB starting at offset == alloc_len reads the next slab page out and gets its content returned over the fabric (an empirical run on a default nvmet-tcp loopback target leaked 81 canonical kernel pointers in one Get Log Page response). Pointing the offset at unmapped kernel memory faults the in-kernel memcpy and crashes (or panics, on panic_on_oops=1) the target host instead. The attacker-controlled source-side offset pattern "nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)" is unique to nvmet_execute_disc_get_log_page in the entire nvmet codebase: every other Get Log Page handler in admin-cmd.c either ignores lpo (and silently starts every response at offset 0) or tracks a local destination offset with a fixed source pointer. Validate the host-supplied offset against the log page size, cap the copy length to what is actually available, and zero-fill any remainder of the host transfer buffer. The zero-fill matches the existing short-response pattern in nvmet_execute_get_log_changed_ns() (admin-cmd.c) and prevents leaking transport SGL contents when the host asks for more bytes than the log page contains.

Timeline

Scores

EPSS (exploitation in 30 days)

0.80% · top 43% of all CVEs (12 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.

Affected products

• Linux · Linux

  • affected a07b4970f464f13640e28e16dad6cfa33647cc99 – < ff815b5e8688dcf68529b7f0fde8de5847f63f1e
  • affected a07b4970f464f13640e28e16dad6cfa33647cc99 – < 8ae9bb92fc9a712a8d32da9c5fd657101f9b260b
  • affected a07b4970f464f13640e28e16dad6cfa33647cc99 – < 33b974eb626154ae9348f2bac7de84cb2a3d9dd4
  • affected a07b4970f464f13640e28e16dad6cfa33647cc99 – < 56c021a0869260d04c4b65d1471936aaf9177114
  • affected a07b4970f464f13640e28e16dad6cfa33647cc99 – < a29b316b9bbfd269f323ab4ba9906a894025680f
  • affected a07b4970f464f13640e28e16dad6cfa33647cc99 – < 53cd102a7a56079b11b897835bd9b94c14e6322c

• Linux · Linux

  • affected 4.8
  • unaffected < 4.8
  • unaffected 6.1.191 – ≤ 6.1.*
  • unaffected 6.6.160 – ≤ 6.6.*
  • unaffected 6.12.96 – ≤ 6.12.*
  • unaffected 6.18.39 – ≤ 6.18.*
  • unaffected 7.1.4 – ≤ 7.1.*
  • unaffected 7.2 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-49032 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-64320](https://cveledger.app/badge/CVE-2026-64320.svg)](https://cveledger.app/cve/CVE-2026-64320)

Record last updated 30 Oct 2026, 12:27 UTC.