Executive brief
A vulnerability in the Linux kernel's NVMe over Fabrics RDMA target implementation can lead to a resource leak. Specifically, when a connection queue is overloaded, the system fails to properly release internal device references. Over time, this could lead to system instability or prevent the proper unloading of hardware drivers.
Technical details
A reference count leak exists in drivers/nvme/target/rdma.c within the nvmet_rdma_queue_connect() function. The function calls nvmet_rdma_find_get_device(), which increments a kref on the network device (ndev). If the host queue backlog is exceeded, the function returns NVME_SC_CONNECT_CTRL_BUSY without calling kref_put(), leading to a permanent leak of the reference. This prevents the underlying device from being properly released or destroyed. The issue has been patched by ensuring the code jumps to the put_device label to release the reference before returning.
Affected products
- Linux Linux 6.8 to 7.1.4
Timeline
- 2026-07-25: advisory: NVD publication date
- 2026-07-25: patched: Patched in various stable branches including 6.12.96, 6.18.39, and 7.1.4