CVE-2026-98726: nvme-multipath: fix underflow in ANA log bounds checks
In the Linux kernel, the following vulnerability has been resolved:
nvme-multipath: fix underflow in ANA log bounds checks
The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups and namespace IDs to parse.
Both bounds checks subtract an untrusted object size from analogsize before comparing the current offset. If the object is larger than the buffer, the sizet subtraction underflows and lets the parser read beyond analogbuf.
Check the current offset before the first subtraction and compare each object size with the remaining buffer instead. This rejects inconsistent ANA data before dereferencing a truncated group descriptor or walking an oversized namespace ID array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Compensating control
In Linux kernel nvme-multipath ANA log bounds checks, check the current offset before the first subtraction and compare each ANA object size with the remaining buffer to reject inconsistent ANA data before dereferencing truncated group descriptors or walking oversized namespace ID arrays.
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds read?
The system must parse NVMe Asymmetric Namespace Access (ANA) log data whose group or namespace-ID object sizes are inconsistent with the allocated ANA log buffer. Exploitation requires malformed or otherwise untrusted ANA data that advertises an object larger than the remaining buffer.
How can I determine whether a system may be exposed?
Review whether the affected kernel is using NVMe multipath and processing ANA log data from NVMe controllers. Systems not using NVMe multipath or ANA log parsing are not described as reaching the vulnerable parsing path.
What is the mitigation if an updated kernel cannot be deployed immediately?
The provided information does not identify a configuration-only mitigation. Reducing exposure would require avoiding the affected NVMe multipath ANA log-processing path or avoiding controllers that provide inconsistent ANA data.