PT-2026-64858 · Linux · Linux

CVE-2026-64534 · Published 2026-07-27 · Updated 2026-07-27

Mitre

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: check INIT FAILED before nvmet req uninit in digest error path

In nvmet tcp try recv ddgst(), when a data digest mismatch is detected, nvmet req uninit() is called unconditionally. However, if the command arrived via the nvmet tcp handle req failure() path, nvmet req init() had returned false and percpu ref tryget live() was never executed. The unconditional percpu ref put() inside nvmet req uninit() then causes a refcount underflow, leading to a WARNING in percpu ref switch to atomic rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock.

Check cmd->flags & NVMET TCP F INIT FAILED before calling nvmet req uninit(), matching the existing pattern in nvmet tcp execute request().

Related Identifiers

CVE-2026-64534

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-64534 · Security Note
• https://git.kernel.org/stable/c/4606467a75cfc16721937272ed29462a750b60c8 · Note
• https://git.kernel.org/stable/c/22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf · Note
• https://git.kernel.org/stable/c/c7874dad84b20433c0fe3919f291a762d40de08b · Note
• https://git.kernel.org/stable/c/2ed3c9d955e8cd6361f130623baa664a75fb345f · Note
• https://git.kernel.org/stable/c/ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e · Note
• https://git.kernel.org/stable/c/d306da8833e75f669d93424fd84940236f3850bc · Note
• https://git.kernel.org/stable/c/e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1 · Note