CVE-2026-64534 in Linux
Summary
by MITRE • 07/27/2026
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock.
Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability resides within the Linux kernel's nvme over tcp subsystem where improper handling of data digest errors leads to critical resource management failures. This issue affects the nvmet_tcp_try_recv_ddgst() function which processes incoming data digest validation during NVMe over TCP communications. When a data digest mismatch occurs, the code executes nvmet_req_uninit() without proper precondition checks, creating a fundamental flaw in reference counting mechanisms that governs how kernel resources are managed.
The technical root cause involves a refcount underflow condition that stems from calling nvmet_req_uninit() unconditionally regardless of the command's initialization state. During normal operations, nvmet_req_init() properly initializes command structures and executes percpu_ref_tryget_live() to increment reference counts. However, when commands arrive through the nvmet_tcp_handle_req_failure() error path, nvmet_req_init() returns false indicating initialization failure, meaning percpu_ref_tryget_live() was never executed. The subsequent unconditional call to nvmet_req_uninit() which contains percpu_ref_put() then decrements a reference count that was never incremented, causing immediate system warnings and diagnostic failures.
This vulnerability creates cascading operational impacts beginning with WARNING messages in percpu_ref_switch_to_atomic_rcu followed by use-after-free diagnostics that indicate memory corruption patterns. The most severe consequence manifests as permanent workqueue deadlocks where the kernel's task scheduling system becomes unresponsive due to corrupted reference counting states. These failures can lead to complete system instability, requiring manual intervention or reboot to restore normal operation, particularly in high-availability environments where such disruptions are unacceptable.
The fix implements a simple but critical conditional check that verifies cmd->flags & NVMET_TCP_F_INIT_FAILED before executing nvmet_req_uninit(). This pattern already exists in the nvmet_tcp_execute_request() function, ensuring consistency across similar error handling paths. The solution directly addresses the core issue by preventing the execution of percpu_ref_put() on uninitialized commands where such operations would cause reference count corruption. This remediation aligns with established security practices for kernel memory management and follows the principle of defensive programming that prevents resource exhaustion scenarios.
From a cybersecurity perspective, this vulnerability maps to CWE-129 Input Validation and the ATT&CK technique T1499.001 Network Denial of Service through resource exhaustion attacks. The vulnerability represents an indirect denial of service vector where normal system operations become disrupted due to improper resource management rather than direct malicious input manipulation. The fix ensures proper reference counting semantics that protect against both immediate system warnings and longer-term stability issues, maintaining kernel integrity while preserving expected functionality for legitimate NVMe over TCP communications. This type of vulnerability demonstrates the critical importance of proper resource lifecycle management in kernel space code where even seemingly minor errors can cascade into severe operational failures affecting entire systems.