In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups… (CVE-2026-98726)

The vulnerability in the Linux kernel's nvme-multipath subsystem concerns improper bounds checking in the parsing of ANA (Asymmetric Namespace Access) log buffers. Specifically, the number of ANA groups advertised sizes the ANA log buffer, but the ANA log header and group descriptors independently specify the number of groups and namespace IDs to parse. The original bounds checks subtract an untrusted object size from the buffer size before comparison, which can cause a size_t underflow if the object size exceeds the buffer, leading to out-of-bounds reads beyond the ana_log_buf. The fix ensures that the current offset is checked before subtraction and that each object size is compared against the remaining buffer size, rejecting inconsistent ANA data before dereferencing truncated descriptors or oversized arrays.

This vulnerability could allow a kernel component to read beyond the intended buffer boundaries when processing ANA log data, potentially leading to memory corruption or information disclosure. However, no known exploits in the wild have been reported. The impact is limited to the Linux kernel's nvme-multipath functionality handling ANA logs.

A fix has been implemented in the Linux kernel to correct the bounds checking logic in the nvme-multipath ANA log parsing. Users should apply the official kernel updates that include this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official repositories for the relevant patch and update accordingly.