PT-2026-64859 · Linux · Linux
CVE-2026-64535
·
Published
2026-07-27
·
Updated
2026-07-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: Fix potential UAF when ddgst mismatch
Shivam Kumar found via vulnerability testing:
When data digest is enabled on an NVMe/TCP connection and a digest
mismatch occurs on a non-final H2C DATA PDU during an R2T-based
data transfer, the digest error handler in nvmet tcp try recv ddgst()
calls nvmet req uninit() — which performs percpu ref put() on the
submission queue — but does NOT mark the command as completed. It
does not set cqe->status, does not modify rbytes done, and does not
clear any flag. When the subsequent fatal error triggers queue
teardown, nvmet tcp uninit data in cmds() iterates all commands,
checks nvmet tcp need data in() for each one, and finds that the
already-uninited command still appears to need data (because
rbytes done < transfer len and cqe->status == 0). It therefore calls
nvmet req uninit() a second time on the same command — a double
percpu ref put against a single percpu ref get.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux