CVE Explorer

CVE-2026-64319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (DH value length) fields without verifying they fit within the allocated buffer of tl bytes. A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a small transfer length but large hl/dhvlen values, causing out-of-bounds heap

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3bb8e7b4899600ea6557718e55cf14a244f7997c9db1b4ab392b04284dfbc476

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nvme/target/fabrics-cmd-auth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semve…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:47e20f0629fd4fb1124ccf6ce822a8bd919c1c205a385e257e9e26c9bdb878f9 · sha256:2b4fa92e0747c02d… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nvme/target/fabrics-cmd-auth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0","status":"affected","version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","versionType":"git"},{"lessThan":"999f6205ede984a786f35f727b01f971b98e215d","status":"affected","version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","versionType":"git"},{"lessThan":"6d7649c1231dac14d906985d2936967e23041c26","status":"affected","version":"db1312d…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:47e20f0629fd4fb1124ccf6ce822a8bd919c1c205a385e257e9e26c9bdb878f9 · sha256:2b4fa92e0747c02d… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:47e20f0629fd4fb1124ccf6ce822a8bd919c1c205a385e257e9e26c9bdb878f9 · sha256:2b4fa92e0747c02d… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:47e20f0629fd4fb1124ccf6ce822a8bd919c1c205a385e257e9e26c9bdb878f9 · sha256:2b4fa92e0747c02d… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:47e20f0629fd4fb1124ccf6ce822a8bd919c1c205a385e257e9e26c9bdb878f9 · sha256:2b4fa92e0747c02d… · /containers/cna/metrics/0/cvssV3_1

Source references

5 source assertions

{"url":"https://git.kernel.org/stable/c/3a413ece2504c70aa34a20be4dafec04e8c741f9"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:47e20f0629fd4fb1124ccf6ce822a8bd919c1c205a385e257e9e26c9bdb878f9 · sha256:2b4fa92e0747c02d… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/6d7649c1231dac14d906985d2936967e23041c26"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:47e20f0629fd4fb1124ccf6ce822a8bd919c1c205a385e257e9e26c9bdb878f9 · sha256:2b4fa92e0747c02d… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:47e20f0629fd4fb1124ccf6ce822a8bd919c1c205a385e257e9e26c9bdb878f9 · sha256:2b4fa92e0747c02d… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/999f6205ede984a786f35f727b01f971b98e215d"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:47e20f0629fd4fb1124ccf6ce822a8bd919c1c205a385e257e9e26c9bdb878f9 · sha256:2b4fa92e0747c02d… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/caa71b3a43ea5c13fe7141cb019ebcb03b8ac857"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:47e20f0629fd4fb1124ccf6ce822a8bd919c1c205a385e257e9e26c9bdb878f9 · sha256:2b4fa92e0747c02d… · /containers/cna/references/3

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer