PT-2026-64542 · Linux · Linux

CVE-2026-64321 · Published 2026-07-25 · Updated 2026-07-25

Mitre

In the Linux kernel, the following vulnerability has been resolved:

nvme: target: rdma: fix ndev refcount leak on queue connect

nvmet rdma queue connect() calls nvmet rdma find get device() which acquires a reference on the returned ndev via kref get(). On the path where the host queue backlog is exceeded and the function returns NVME SC CONNECT CTRL BUSY, reference of ndev is not released, leaking the kref.

Fix this by adding a goto to the existing put device label before the early return.

Related Identifiers

CVE-2026-64321

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-64321 · Security Note
• https://git.kernel.org/stable/c/d65fe42820b890a6a4644de0a95a812471f79ad3 · Note
• https://git.kernel.org/stable/c/a8803c4f0ac3fa7df5551bbb5a8800c434a94357 · Note
• https://git.kernel.org/stable/c/badc53620fe813b3a9f727ef9526f98567c2c898 · Note
• https://git.kernel.org/stable/c/5828517d17eda27f21d29ea14800c9e0a57bad11 · Note