CVE-2026-64535
Received Received - Intake

Use-After-Free in Linux Kernel NVMe/TCP

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64535
EUVD
EUVD-2026-49113

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's NVMe over TCP (nvmet-tcp) subsystem. It occurs when a digest mismatch happens during data transfer with digest enabled. The error handler incorrectly calls nvmet_req_uninit() without completing the command, leading to a double free of the submission queue reference during queue teardown.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe/TCP implementation and requires kernel-level detection. There are no direct network or system commands provided in the context to detect this issue. Monitoring for NVMe/TCP errors or crashes during data transfers with digest enabled may indicate exploitation.

Impact Analysis

This vulnerability could cause system crashes or instability due to memory corruption from the double free. It may lead to denial-of-service conditions if exploited, potentially disrupting NVMe/TCP storage operations on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical flaw in the Linux kernel's NVMe/TCP implementation. Compliance impacts would depend on system configuration and usage rather than the vulnerability itself.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the nvmet-tcp UAF issue. Monitor NVMe/TCP connections for digest mismatches and ensure proper error handling in data transfers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64535. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart