CVE-2026-64321 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
nvme: target: rdma: fix ndev refcount leak on queue connect
nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() which acquires a reference on the returned ndev via kref_get(). On the path where the host queue backlog is exceeded and the function returns NVME_SC_CONNECT_CTRL_BUSY, reference of ndev is not released, leaking the kref.
Fix this by adding a goto to the existing put_device label before the early return.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability resides in the Linux kernel's nvme target rdma implementation where a reference count leak occurs in the nvmet_rdma_queue_connect() function. The issue stems from improper resource management during error handling paths within the RDMA queue connection process. When the host queue backlog exceeds its limits, the function returns with NVME_SC_CONNECT_CTRL_BUSY error code but fails to release the acquired reference on the network device structure. The vulnerability represents a classic memory leak scenario where kernel references are not properly released, leading to potential resource exhaustion over time.
The technical flaw manifests in the nvmet_rdma_queue_connect() function's control flow where nvmet_rdma_find_get_device() is called to obtain a reference to the network device ndev structure using kref_get() for reference counting. However, when the queue backlog constraint is violated and an early return occurs with NVME_SC_CONNECT_CTRL_BUSY, the code path bypasses the normal cleanup mechanism that would typically release this reference through an existing put_device label. This creates a scenario where the network device reference count remains incremented indefinitely, preventing proper resource deallocation.
The operational impact of this vulnerability extends beyond simple memory leak characteristics to potentially compromise system stability and performance. As the reference count leak accumulates over time with repeated queue connection attempts, it can lead to exhaustion of available network device resources. This may result in denial of service conditions where new connections cannot be established due to resource constraints, or in more severe cases, cause system instability through memory pressure. The vulnerability affects systems utilizing NVMe over Fabrics RDMA implementations and could be exploited by malicious actors who repeatedly attempt queue connections to trigger the leak condition.
The fix implemented addresses this issue by introducing a goto statement that redirects execution to the existing put_device label before the early return occurs. This ensures that regardless of the error path taken, the reference count is properly decremented through the established cleanup mechanism. The solution follows established kernel programming practices for resource management and aligns with common patterns found in the Linux kernel's reference counting implementation. This fix demonstrates proper error handling hygiene where all acquisition paths have corresponding release mechanisms, preventing resource leaks that could accumulate over time.
This vulnerability type maps to CWE-404, which specifically addresses improper resource release or unbalanced resource management issues in software systems. The reference count leak represents a fundamental failure in resource lifecycle management where acquired resources are not properly released during error conditions. From an ATT&CK perspective, this vulnerability could be leveraged by adversaries seeking to perform resource exhaustion attacks against NVMe target implementations, potentially leading to system availability compromise through denial of service conditions. The fix reinforces proper kernel development practices around reference counting and error path handling, which are critical for maintaining system reliability in enterprise storage environments.