The Linux kernel vulnerability CVE-2026-64319 involves the nvmet-auth subsystem where the function nvmet_auth_reply() accesses a variable-length array rval[] using attacker-controlled hash length (hl) and DH value length (dhvlen) fields without verifying these fit within the allocated buffer size (tl). An attacker can craft a DHCHAP_REPLY message with a small transfer length but large hl/dhvlen values, causing out-of-bounds heap reads up to 526 bytes beyond the buffer. This occurs pre-authentication and can lead to information disclosure or denial of service. The fix adds bounds validation ensuring the sum of sizeof(*data) + 2*hl + dhvlen does not exceed tl before accessing these fields. The vulnerability affects Linux kernel versions prior to the patched 7.0.0 series releases provided by Ubuntu.

The vulnerability allows a remote attacker controlling an NVMe-oF initiator to cause out-of-bounds heap reads in the Linux kernel's nvmet-auth component before authentication. This can lead to information disclosure and denial of service. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and availability impact.

A fix is available and has been officially released by Ubuntu in updated Linux kernel packages for the affected versions. Users should apply the security updates and reboot their systems to ensure the vulnerability is remediated. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigation steps are necessary beyond applying the official patches.