PT-2026-64541 · Linux · Linux
CVE-2026-64320
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
nvmet execute disc get log page() validates only the dword alignment
of the host-supplied Log Page Offset (lpo). The 64-bit offset is then
added to a small kzalloc'd buffer that holds the discovery log page
and the result is passed straight to nvmet copy to sgl(), which
memcpy()s data len bytes out to the host with no source-side bound
check:
u64 offset = nvmet get log page offset(req->cmd); /* 64-bit host /
size t data len = nvmet get log page len(req->cmd); / 32-bit host /
...
if (offset & 0x3) { ... } / only check */
...
alloc len = sizeof(*hdr) + entry size * discovery log entries(req);
buffer = kzalloc(alloc len, GFP KERNEL);
...
status = nvmet copy to sgl(req, 0, buffer + offset, data len);
The Discovery controller is unauthenticated -- nvmet host allowed()
returns true unconditionally for the discovery subsystem -- so the call
is reachable pre-authentication by any TCP/RDMA/FC peer that can reach
the nvmet target. With a discovery log page of ~1 KiB, an attacker
requesting up to 4 KiB starting at offset == alloc len reads the next
slab page out and gets its content returned over the fabric (an
empirical run on a default nvmet-tcp loopback target leaked 81
canonical kernel pointers in one Get Log Page response). Pointing the
offset at unmapped kernel memory faults the in-kernel memcpy and
crashes (or panics, on panic on oops=1) the target host instead.
The attacker-controlled source-side offset pattern
"nvmet copy to sgl(req, 0, buffer + ATTACKER OFFSET, ...)" is unique
to nvmet execute disc get log page in the entire nvmet codebase: every
other Get Log Page handler in admin-cmd.c either ignores lpo (and
silently starts every response at offset 0) or tracks a local
destination offset with a fixed source pointer.
Validate the host-supplied offset against the log page size, cap the
copy length to what is actually available, and zero-fill any remainder
of the host transfer buffer. The zero-fill matches the existing
short-response pattern in nvmet execute get log changed ns()
(admin-cmd.c) and prevents leaking transport SGL contents when the
host asks for more bytes than the log page contains.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux