CVE-2026-64534
Received Received - Intake

Kernel Memory Corruption in NVMe-TCP Target

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64534
EUVD
EUVD-2026-49112

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's NVMe over TCP (nvmet-tcp) implementation. It occurs when a data digest mismatch is detected during communication. The issue arises because nvmet_req_uninit() is called without checking if the command initialization failed. This leads to a reference count underflow, causing a warning, use-after-free error, and a permanent workqueue deadlock.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe over TCP (nvmet-tcp) implementation. Detection requires checking kernel logs for warnings related to refcount underflow or workqueue deadlocks in nvmet-tcp. Monitor logs for messages like 'WARNING in percpu_ref_switch_to_atomic_rcu' or 'permanent workqueue deadlock'.

Impact Analysis

This vulnerability can cause system instability, including crashes, data corruption, or denial of service due to workqueue deadlocks. Systems using NVMe over TCP for storage may experience performance degradation or complete failure in handling storage requests.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level kernel issue in the Linux NVMe over TCP subsystem. Compliance impacts would depend on system-specific configurations and whether the vulnerability leads to data exposure or integrity issues, which are not described here.

Mitigation Strategies

Apply the Linux kernel patch that addresses this issue. Update to a kernel version containing the fix for nvmet-tcp digest error handling. If immediate patching is not possible, disable NVMe over TCP (nvmet-tcp) functionality as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64534. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart