Junglewise Threat Intelligence

CVE-2026-74386: Linux kernel nvmet-tcp page fragment cache leak

CVE-2026-74386 · Severity: info · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's NVMe over TCP target driver leaks memory when connections fail during initialization. When a connection closes at the wrong time during the setup process, cached memory pages are not properly released, leading to gradual memory exhaustion if this occurs repeatedly. This is a resource exhaustion issue that could degrade system performance or availability over time.

Technical details

This is a memory leak (resource exhaustion) in the nvmet-tcp driver's nvmet_tcp_alloc_queue() function. When a connection is closed during allocation (e.g., nvmet_tcp_set_queue_sock() fails), error handling jumps through out_destroy_sq and out_ida_remove without draining the page fragment cache (queue->pf_cache). Although individual page fragments are freed via nvmet_tcp_free_cmd() in some error paths, the underlying page cache reference is never released. The first pf_cache allocation occurs after ida_alloc() succeeds, meaning every failed allocation after that point leaks one page. The fix adds a page_frag_cache_drain() call in the out_ida_remove error path before freeing the queue structure. This is a local issue affecting any NVMe over TCP target workload with repeated connection failures.

Affected products

  • Linux Linux kernel Kernels with nvmet-tcp driver (since introduction of NVMe over TCP target support)

Timeline

  • 2026-08-15: disclosed
  • 2026-05-26: patched: Fix committed upstream; backported to stable kernels by 2026-07-24

References

Related threats