PT-2026-64859 · Linux · Linux
CVE-2026-64535
·
Publicado
2026-07-27
·
Atualizado
2026-07-27
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: Fix potential UAF when ddgst mismatch
Shivam Kumar found via vulnerability testing:
When data digest is enabled on an NVMe/TCP connection and a digest
mismatch occurs on a non-final H2C DATA PDU during an R2T-based
data transfer, the digest error handler in nvmet tcp try recv ddgst()
calls nvmet req uninit() — which performs percpu ref put() on the
submission queue — but does NOT mark the command as completed. It
does not set cqe->status, does not modify rbytes done, and does not
clear any flag. When the subsequent fatal error triggers queue
teardown, nvmet tcp uninit data in cmds() iterates all commands,
checks nvmet tcp need data in() for each one, and finds that the
already-uninited command still appears to need data (because
rbytes done < transfer len and cqe->status == 0). It therefore calls
nvmet req uninit() a second time on the same command — a double
percpu ref put against a single percpu ref get.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux