The Linux kernel's nvmet_execute_disc_get_log_page() function improperly validates the host-supplied 64-bit Log Page Offset, only checking for dword alignment but not ensuring it is within the allocated buffer size. This leads to an out-of-bounds heap read when the offset plus requested data length exceeds the discovery log page buffer. Since the discovery controller is unauthenticated, any remote peer with network access to the nvmet target can trigger this pre-authentication. An attacker can leak kernel memory contents, including kernel pointers, or cause kernel crashes by referencing unmapped memory. The fix involves validating the offset against the log page size, limiting the copy length to available data, and zero-filling any remaining bytes to prevent leakage of transport scatter-gather list contents.

An unauthenticated remote attacker with network access to the nvmet target can exploit this vulnerability to read out-of-bounds kernel memory, potentially leaking sensitive kernel pointers and other data. Additionally, crafted requests can cause kernel crashes or panics, leading to denial of service. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by validating the host-supplied offset against the log page size, capping the copy length, and zero-filling the remainder of the transfer buffer. Users should apply the official Linux kernel updates once available to address this issue. Until patched, restricting network access to nvmet targets and disabling the discovery controller if not needed may reduce exposure.