Linux Kernel NVMe Discovery Log Heap Buffer Over-Read

CVE-2026-64320 is a critical pre-authentication heap buffer over-read vulnerability in the Linux kernel's NVMe target discovery service. An unauthenticated remote attacker can exploit insufficient bounds checking on the Log Page Offset parameter in the Discovery Get Log Page command to read sensitive data from kernel heap memory and transmit it back to the attacker. This vulnerability affects any system exposing NVMe-oF (NVMe over Fabrics) target functionality, potentially allowing information disclosure of cryptographic keys, memory addresses for ASLR bypass, or other sensitive kernel data before authentication occurs.

While CVE-2026-64320 does not currently map to MITRE ATT&CK techniques in public databases, Casky's Claude-powered analysis engine would identify the attack pattern as consistent with T1005 (Data from Local System) combined with pre-authentication access vectors. Practitioners using Casky would observe detection signals focused on: (1) NVMe protocol fuzzing or offset parameter manipulation attempts; (2) unexpected kernel heap memory access patterns in nvmet subsystem logging; (3) Discovery service responses containing out-of-bounds memory content. The platform's extended reasoning would correlate the dword-alignment validation bypass with common kernel exploitation techniques, flagging this as a critical data exfiltration risk requiring immediate kernel patching across NVMe-exposed infrastructure.