Executive brief
A vulnerability in the Linux kernel's NVMe target implementation allows unauthenticated remote attackers to read sensitive information from the system's memory or cause a system crash. The issue exists in the Discovery service, which helps computers find storage resources over a network. An attacker can exploit this to leak internal kernel data or disrupt storage services, potentially leading to a full system outage.
Technical details
An out-of-bounds heap read exists in nvmet_execute_disc_get_log_page() within the Linux kernel's NVMe target (nvmet) implementation. The function fails to validate the host-supplied 64-bit Log Page Offset (lpo) against the size of the allocated buffer. Because the Discovery controller is unauthenticated, any network peer (TCP/RDMA/FC) can provide a large offset to read adjacent kernel heap memory or trigger a kernel panic by accessing unmapped memory. Attackers can leak sensitive kernel pointers or cause a denial-of-service. The issue has been resolved by validating the offset against the log page size and capping the copy length.
Affected products
- Linux Linux Kernel a07b4970f464 to 33b974eb6261
Timeline
- 2026-05-27: other: Vulnerability reported by researcher
- 2026-07-18: patched: Fix committed to stable kernel trees
- 2026-07-25: disclosed: CVE published