Executive brief
The Linux kernel's NVMe target TCP subsystem has a resource management flaw in TLS handshake processing. When a socket fails to transition to the established state, the kernel neglects to properly clean up queues and sockets, resulting in memory and file descriptor leaks that could degrade system stability over time.
Technical details
The vulnerability is a missing error-handling bug in the nvmet_tcp_tls_handshake_done() function (drivers/nvme/target/tcp.c). The function calls nvmet_tcp_set_queue_sock() to configure socket callbacks after TLS handshake completion, but does not check the return value. If nvmet_tcp_set_queue_sock() fails because the socket is not in TCP_ESTABLISHED state, socket callbacks remain improperly configured, leading to queue and socket object leakage. The fix captures the return value and calls nvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup. This is a local/adjacent network vector affecting systems using NVMe over TCP with TLS.
Affected products
- Linux Linux Kernel versions with nvmet-tcp TLS support (prior to commit 7ef789703e2b91775dcb36b2efa46325be31a2a0)
Timeline
- 2026-08-15: disclosed
- 2026-05-27: patched: Patch commit 7ef789703e2b91775dcb36b2efa46325be31a2a0 merged upstream