External risk intelligence

Linux Kernel NVMe-oF Authentication Heap Out-of-Bounds Read.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-64319

The vulnerability affects NVMe-oF targets, which are network-accessible. While exploitation is possible over a network, these services are typically deployed within restricted storage area networks or data center fabrics rather than directly exposed to the public internet, making widespread external reachability less common than standard web-facing services.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability concerns the Linux kernel's handling of authentication messages in NVMe-oF (NVMe over Fabrics) targets. Specifically, improper validation of message payload bounds could allow a malicious initiator to trigger out-of-bounds heap reads, potentially impacting data confidentiality and system availability. The main concern is confirming relevance and exposure.

Issue: Flaw in kernel authentication message handling.
Why remember: Affects data integrity and system availability.
Executive takeaway: Verify exposure of NVMe-oF targets.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted authentication reply message over the network to a vulnerable Linux kernel system. This message can cause the system to read data from outside its intended memory boundaries, potentially leading to sensitive information disclosure or denial of service. The vulnerability is exploitable even before a user is authenticated.

Network access to NVMe-oF target required.
Malicious reply message triggers out-of-bounds read.
Risk of data disclosure or denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a malicious NVMe-oF initiator to perform out-of-bounds heap reads on a target system. This could occur when DH authentication is configured and the target processes a crafted reply message with specific lengths that exceed the allocated buffer. The vulnerability is exploitable pre-authentication.

Kernel memory could be read.
Malicious network messages could be sent.
Information disclosure or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's NVMe-oF authentication mechanism requires a coordinated response. Infrastructure or platform teams managing storage and networking are likely responsible for the affected kernel components. The first practical move is to inventory systems utilizing NVMe-oF, assess their exposure and business criticality, and identify the accountable system owners to prioritize remediation efforts.

Infrastructure teams should own the issue.
Verify NVMe-oF reachability and criticality.
Plan risk-based remediation and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel nvmet-auth component used for?

This component manages authentication for NVMe over Fabrics (NVMe-oF). NVMe-oF allows servers to access high-speed storage devices across a network instead of being directly attached to the local machine. It uses the DH-HMAC-CHAP protocol to verify the identity of initiators—the clients requesting storage—before allowing them to connect to the storage target. This ensures that only authorized systems can perform data read and write operations.

What is the vulnerability in CVE-2026-64319?

This is an out-of-bounds heap read vulnerability. The system fails to properly check if the length of the data provided in an authentication message matches the actual size of the buffer reserved to hold it. If a message specifies fields that are larger than the allocated memory, the kernel may read past the intended buffer into surrounding memory. This can lead to sensitive information disclosure or cause the system to crash, resulting in a denial of service.

How does an attacker trigger this vulnerability?

An attacker initiates the vulnerability by sending a malicious NVMe-oF authentication reply message to a target system. Crucially, this requires DH authentication to be explicitly configured on the storage target. The bug is not triggered by standard, well-formed authentication requests; it only occurs when the initiator deliberately crafts a message with mismatched length fields that deceive the target into reading outside of its defined memory boundaries.

Why does Halo Surface Signal categorize this as an external risk?

Halo Surface Signal flags this as external because the vulnerability is reachable over a network. While many NVMe-oF targets are restricted to internal storage fabrics or private data center networks, the protocol itself is network-based. Because it does not require prior authentication to trigger the flaw, any system configured to accept these network connections is theoretically reachable by any actor who has established a path to that specific service.

What is the first step to address this CVE?

Begin by auditing your infrastructure to identify which systems are currently running NVMe-oF targets with DH authentication enabled. Once these assets are mapped, evaluate their network placement and business criticality to prioritize which machines require updates. Coordinate with your Linux kernel maintenance team to track official upstream patches, as applying the appropriate kernel update is the primary method to resolve the underlying buffer validation logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.