All vulnerabilities
CVE-2026-98726

Linux: nvme-multipath: fix underflow in ANA log bounds checks

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3045128294d347fd38542ad6e174b1b34d9c0751Also 03a0c21f0fd7a872953aae5714303d8f38d1e567, 49e8a3224c91fd5fbf22f4adcca6c8209cfdd6fe and 1 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 3045128294d347fd38542ad6e174b1b34d9c0751LinuxCVE List
  • 03a0c21f0fd7a872953aae5714303d8f38d1e567LinuxCVE List
  • 49e8a3224c91fd5fbf22f4adcca6c8209cfdd6feLinuxCVE List
  • 63fa2d9c9c37020bd2703fe2a6a38027b5abeb15LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-multipath: fix underflow in ANA log bounds checks

The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups and namespace IDs to parse.

Both bounds checks subtract an untrusted object size from ana_log_size before comparing the current offset. If the object is larger than the buffer, the size_t subtraction underflows and lets the parser read beyond ana_log_buf.

Check the current offset before the first subtraction and compare each object size with the remaining buffer instead. This rejects inconsistent ANA data before dereferencing a truncated group descriptor or walking an oversized namespace ID array.

Text from CVE List

Affected versions 12

  • Linuxaffected: 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba before 3045128294d347fd38542ad6e174b1b34d9c0751CVE List
  • Linuxaffected: 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba before 03a0c21f0fd7a872953aae5714303d8f38d1e567CVE List
  • Linuxaffected: 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba before 49e8a3224c91fd5fbf22f4adcca6c8209cfdd6feCVE List
  • Linuxaffected: 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba before e5cdb0c0a51e8ff49914ae16ef5360010c40cc85CVE List
  • Linuxaffected: 0d0b660f214dc4905db7b6bc998bad0c16dfb1ba before 63fa2d9c9c37020bd2703fe2a6a38027b5abeb15CVE List
  • Linuxaffected: 4.19CVE List
  • Linuxunaffected: all versions before 4.19CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5