Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98726

nvme-multipath: fix underflow in ANA log bounds checks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups and namespace IDs to parse. Both bounds checks subtract an untrusted object size from ana_log_size before comparing the current offset. If the object is larger than the buffer, the size_t subtraction underflows and lets the parser read beyond ana_log_buf. Check the current offset before the first subtraction and compare each object size with the remaining buffer instead. This rejects inconsistent ANA data before dereferencing a truncated group descriptor or walking an oversized namespace ID array.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba to < 3045128294d347fd38542ad6e174b1b34d9c0751affected
  • 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba to < 03a0c21f0fd7a872953aae5714303d8f38d1e567affected
  • 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba to < 49e8a3224c91fd5fbf22f4adcca6c8209cfdd6feaffected
  • 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba to < e5cdb0c0a51e8ff49914ae16ef5360010c40cc85affected
  • 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba to < 63fa2d9c9c37020bd2703fe2a6a38027b5abeb15affected

Linux Linux

Default version status: affected

  • 4.19affected
  • 0 to < 4.19unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.113 to ≤ 6.12.*unaffected
  • 6.18.56 to ≤ 6.18.*unaffected
  • 7.2.10 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References