CVE-2026-64319

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: validate reply message payload bounds against transfer length

nvmetauthreply() accesses the variable-length rval[] array using

attacker-controlled hl (hash length) and dhvlen (DH value length) fields

without verifying they fit within the allocated buffer of tl bytes.

A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a

small transfer length but large hl/dhvlen values, causing out-of-bounds

heap reads when the target processes the DH public key (rval + 2*hl) or

performs the host response memcmp.

With DH authentication configured, the OOB pointer is passed directly to

sginitone() and read by cryptokppcomputesharedsecret(), reaching

up to 526 bytes past the buffer. This is exploitable pre-authentication.

Add bounds validation ensuring sizeof(data) + 2hl + dhvlen <= tl before

any access to the variable-length fields.

Discovered by Atuin - Automated Vulnerability Discovery Engine.