CVE-2026-74386

Received Received - Intake

Memory Leak in Linux Kernel NVMe-TCP

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmet_tcp_alloc_queue(), when a connection is closed during the allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), the error handling jumps to out_destroy_sq and then to out_ida_remove without draining the page fragment cache. Although nvmet_tcp_free_cmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pf_cache is never released. The first allocation using pf_cache is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens after ida_alloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed. Fix this by calling page_frag_cache_drain() before freeing the queue structure in the out_ida_remove label.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74386

EUVD

EUVD-2026-59533

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the NVMe over TCP (nvmet-tcp) subsystem. When a connection fails during the allocation process, the page fragment cache is not properly released, leading to a gradual accumulation of unused memory. This can eventually cause memory exhaustion if connections are repeatedly opened and closed.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe over TCP (nvmet-tcp) subsystem and may not have direct detection commands. Monitor system memory usage and kernel logs for errors related to nvmet-tcp or page cache leaks. Check for repeated connection failures in NVMe/TCP subsystem logs.

Impact Analysis

The vulnerability could lead to system instability or crashes due to memory exhaustion. If exploited repeatedly, it may degrade performance or cause denial-of-service conditions on systems using NVMe over TCP.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory leak issue in the Linux kernel's nvmet-tcp subsystem that could lead to resource exhaustion but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Apply the kernel patch that fixes the page fragment cache leak in nvmet-tcp. Update to a Linux kernel version that includes the fix. If immediate patching is not possible, monitor memory usage and restart affected services if leaks are detected.

Hi! I’m here to help you understand CVE-2026-74386. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70