Executive brief
The Linux kernel's NVMe over TCP target driver leaks memory when connections fail during initialization. When a connection closes at the wrong time during the setup process, cached memory pages are not properly released, leading to gradual memory exhaustion if this occurs repeatedly. This is a resource exhaustion issue that could degrade system performance or availability over time.
Technical details
This is a memory leak (resource exhaustion) in the nvmet-tcp driver's nvmet_tcp_alloc_queue() function. When a connection is closed during allocation (e.g., nvmet_tcp_set_queue_sock() fails), error handling jumps through out_destroy_sq and out_ida_remove without draining the page fragment cache (queue->pf_cache). Although individual page fragments are freed via nvmet_tcp_free_cmd() in some error paths, the underlying page cache reference is never released. The first pf_cache allocation occurs after ida_alloc() succeeds, meaning every failed allocation after that point leaks one page. The fix adds a page_frag_cache_drain() call in the out_ida_remove error path before freeing the queue structure. This is a local issue affecting any NVMe over TCP target workload with repeated connection failures.
Affected products
- Linux Linux kernel Kernels with nvmet-tcp driver (since introduction of NVMe over TCP target support)
Timeline
- 2026-08-15: disclosed
- 2026-05-26: patched: Fix committed upstream; backported to stable kernels by 2026-07-24