Linux Kernel NVMe-oF Authentication Buffer Bounds Validation Flaw

CVE-2026-64319 is a critical heap buffer overflow vulnerability in the Linux kernel's NVMe-oF (NVMe over Fabrics) authentication handler. The nvmet_auth_reply() function fails to validate that attacker-controlled hash length (hl) and Diffie-Hellman value length (dhvlen) fields fit within the allocated reply message buffer before accessing the rval[] array. A malicious NVMe-oF initiator can exploit this by crafting a specially crafted DHCHAP_REPLY message with a small transfer length but oversized hl/dhvlen values, triggering an out-of-bounds heap read or write. This affects Linux systems running NVMe-oF target implementations, impacting storage infrastructure and hypervisors that expose NVMe services to untrusted networks, with a CVSS score of 9.1 indicating severe risk of system compromise.

While Casky currently shows zero matching skills for this specific CVE, Claude AI's extended reasoning capabilities would identify the underlying attack pattern as a variant of CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Practitioners using Casky should monitor for evidence of Exploitation (MITRE ATT&CK T1190) attempts against NVMe-oF services, including malformed protocol messages in kernel logs or unexpected memory access patterns. The detection strategy would focus on input validation gaps—specifically, tracking cases where user-supplied length fields bypass bounds checking before array access—combined with privilege escalation indicators (T1134) that follow successful heap corruption. As the threat landscape evolves, Casky's skill library will expand to map such memory safety vulnerabilities to attack chains, enabling practitioners to correlate suspicious NVMe authentication traffic with post-exploitation lateral movement.