CVE-2026-64321: nvme: target: rdma: fix ndev refcount leak on queue connect
In the Linux kernel, the following vulnerability has been resolved:
nvme: target: rdma: fix ndev refcount leak on queue connect
nvmetrdmaqueueconnect() calls nvmetrdmafindgetdevice() which acquires a reference on the returned ndev via krefget(). On the path where the host queue backlog is exceeded and the function returns NVMESCCONNECTCTRLBUSY, reference of ndev is not released, leaking the kref.
Fix this by adding a goto to the existing putdevice label before the early return.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel NVMe target RDMA queue-connect path are exposed when host queue backlog limits can be exceeded. The issue occurs during connection handling for an NVMe RDMA target device.
What conditions are required to trigger the leak?
A queue-connect request must reach nvmet_rdma_queue_connect(), acquire an ndev reference, and then hit the host queue backlog-exceeded path that returns NVME_SC_CONNECT_CTRL_BUSY. Each occurrence on that path leaks the acquired device reference.
What is the operational impact if it is repeatedly triggered?
Repeated connections that exceed the host queue backlog can accumulate unreleased ndev references. The CVSS vector identifies availability impact only, with no confidentiality or integrity impact.
What can be done if the patch cannot be applied immediately?
The provided data identifies the backlog-exceeded queue-connect path as the trigger. Limiting or monitoring repeated queue connection attempts that receive controller-busy responses may reduce exposure until the available patch can be deployed.