Cloudanix VulnDB

CVE-2026-98726

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel reads certain storage management data could let an attacker peek at or crash parts of system memory.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Integer underflow in size_t subtraction during ANA log header and group descriptor parsing allows out-of-bounds read past the allocated ana_log_buf when untrusted size fields exceed the buffer.

Why it matters to the business

Systems using NVMe multipath may experience kernel memory disclosure or crashes, risking sensitive data exposure or denial of service on storage paths.

How an attack unfolds

An attacker with control over NVMe controller responses supplies an Identify Controller structure and subsequent ANA log whose advertised group/namespace counts cause the bounds checks to underflow, permitting the parser to dereference and walk memory beyond the allocated buffer.

How to fix it

Apply the upstream fix that adds offset checks before subtraction and validates each object size against remaining buffer length; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the patched kernel is running, then exercise NVMe multipath with deliberately inconsistent ANA data to verify rejection before any out-of-bounds access occurs.

Typical attack path

  1. Compromise or emulate an NVMe target/controller that returns crafted Identify Controller data
  2. Advertise ANA groups larger than the kernel-allocated log buffer
  3. Supply ANA log header and descriptors whose sizes trigger underflow in the offset calculations
  4. Trigger repeated ANA log fetches via multipath events or namespace changes to read kernel memory

How to detect it

Review kernel logs for NVMe ANA parsing warnings or oopses, and inspect audit trails around NVMe target attachment or namespace events for unexpected buffer handling failures.

What your security team should do

  • Prioritize kernel updates on all hosts exposing NVMe multipath storage
  • Monitor vendor advisories for distribution-specific backports
  • Limit exposure by restricting untrusted NVMe targets until patched

The record

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups and namespace IDs to parse. Both bounds checks subtract an untrusted object size from ana_log_size before comparing the current offset. If the object is larger than the buffer, the size_t subtraction underflows and lets the parser read beyond ana_log_buf. Check the current offset before the first subtraction and compare each object size with the remaining buffer instead. This rejects inconsistent ANA data before dereferencing a truncated group descriptor or walking an oversized namespace ID array.

Affected packages

Ecosystem Package Introduced Fixed