The Linux kernel's nvmet-auth module contained a vulnerability (CVE-2026-64319) where the nvmet_auth_reply() function accessed a variable-length array (rval[]) using attacker-controlled parameters (hl and dhvlen) without ensuring these values fit within the allocated buffer length (tl). This flaw allowed crafted DHCHAP_REPLY messages with small transfer lengths but large hl/dhvlen values to trigger out-of-bounds heap reads when processing the Diffie-Hellman public key or during host response comparison. The out-of-bounds read could reach up to 526 bytes beyond the buffer and is exploitable before authentication. The vulnerability was fixed by adding a validation check to ensure the total size of the data plus 2*hl plus dhvlen does not exceed the transfer length before accessing these fields.

An attacker controlling an NVMe-oF initiator can exploit this vulnerability to cause out-of-bounds heap reads in the Linux kernel's nvmet-auth component before authentication. This could potentially lead to information disclosure or kernel memory corruption. However, no known exploits in the wild have been reported. The impact is limited to systems using NVMe over Fabrics with DH authentication configured.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved by adding bounds validation in the Linux kernel source. Users should monitor official Linux kernel releases and apply updates that include this fix once available. No alternative mitigations are specified.