CVE-2026-72128

Received Received - Intake

Refcount Leak in Linux Kernel NVMe Target

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmet_sq_create() In nvmet_sq_create(), a reference on the ctrl is taken via kref_get_unless_zero() before calling nvmet_check_sqid(). If nvmet_check_sqid() fails, the function returns the error directly without releasing the reference, leading to a leak. Fix this by jumping to the "ctrl_put" label, which already performs the necessary nvmet_ctrl_put(ctrl). This ensures the reference is properly released on this error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72128

EUVD

EUVD-2026-58886

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	nvmet	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a reference count leak occurs in the nvmet_sq_create function. The issue happens when a reference to a controller is taken but not released if an error occurs during a check, leading to a resource leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe Target (nvmet) subsystem and involves a reference count leak in nvmet_sq_create(). Detection requires checking kernel logs for errors related to nvmet or NVMe operations. Commands like dmesg | grep nvmet or journalctl -k | grep nvmet may help identify issues. Ensure your kernel version is updated to the patched version.

Impact Analysis

This vulnerability could lead to resource exhaustion in systems using the Linux kernel's NVMe target subsystem. It may cause performance degradation or system instability due to unreleased memory or other system resources.

Compliance Impact

This vulnerability is a local kernel memory leak in the Linux nvmet subsystem. It does not directly impact data confidentiality, integrity, or availability in a way that would violate GDPR or HIPAA requirements. Compliance risks are minimal as the issue does not expose or alter sensitive data.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for CVE-2026-72128. If updating is not immediately possible, disable the NVMe Target (nvmet) subsystem if not in use. Monitor kernel logs for any signs of the vulnerability being exploited.

Hi! I’m here to help you understand CVE-2026-72128. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70