Live › vulnerability › CVE-2026-98726
Go to dashboardThe Linux kernel's NVMe multipath code subtracts an untrusted object size from the ANA log buffer length, so an oversized value underflows and the parser reads beyond the buffer. The sources do not say what an attacker gets beyond an out-of-bounds read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the Linux kernel with NVMe storage that uses native NVMe multipath, where the ANA log is read from a storage controller. Hosts without NVMe multipath or without NVMe-oF attached storage are unlikely to parse ANA data at all. The sources do not say which kernel versions are affected.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel builds listed in the NVD entry.nvme_core module is loaded with lsmod | grep nvme and whether multipath is in use (cat /sys/module/nvme_core/parameters/multipath).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
nvme-multipath: fix underflow in ANA log bounds checks
The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups and namespace IDs to parse.
Both bounds checks subtract an untrusted object size from ana_log_size before comparing the current offset. If the object is larger than the buffer, the size_t subtraction underflows and lets the parser read beyond ana_log_buf.
Check the current offset before the first subtraction and compare each object size with the remaining buffer instead. This rejects inconsistent ANA data before dereferencing a truncated group descriptor or walking an oversized namespace ID array.
This page as .md · .json · in your agent: get_signal("CVE-2026-98726")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.