Executive brief
A vulnerability in the Linux kernel's NVMe-over-TCP (nvmet-tcp) component could allow a remote attacker to cause a system crash or a permanent service deadlock. The issue occurs when the system incorrectly handles network data errors, leading to internal memory management failures. This can result in a 'use-after-free' condition, potentially destabilizing the server and requiring a reboot to restore operations.
Technical details
A reference count underflow vulnerability exists in the Linux kernel's NVMe-over-TCP (nvmet-tcp) target driver within the `nvmet_tcp_try_recv_ddgst()` function. When a data digest mismatch occurs on a command that previously failed initialization (via `nvmet_tcp_handle_req_failure`), the driver unconditionally calls `nvmet_req_uninit()`. Because `percpu_ref_tryget_live()` was never called for these failed commands, the subsequent `percpu_ref_put()` inside the uninit routine triggers a refcount underflow. This leads to a use-after-free condition and a permanent workqueue deadlock. The fix introduces a check for the `NVMET_TCP_F_INIT_FAILED` flag to ensure uninitialization only occurs when appropriate.
Affected products
- Linux Linux Kernel 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97
Timeline
- 2026-07-27: advisory: CVE-2026-64534 published by NVD
- 2026-07-24: patched: Fix committed to Linux stable trees
References
- https://git.kernel.org/stable/c/22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf
- https://git.kernel.org/stable/c/2ed3c9d955e8cd6361f130623baa664a75fb345f
- https://git.kernel.org/stable/c/4606467a75cfc16721937272ed29462a750b60c8
- https://git.kernel.org/stable/c/ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e
- https://git.kernel.org/stable/c/c7874dad84b20433c0fe3919f291a762d40de08b
- https://git.kernel.org/stable/c/d306da8833e75f669d93424fd84940236f3850bc
- https://git.kernel.org/stable/c/e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1