CVE-2026-64321: nvme: target: rdma: fix ndev refcount leak on queue connect

Published Jul 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

nvme: target: rdma: fix ndev refcount leak on queue connect

nvmetrdmaqueueconnect() calls nvmetrdmafindgetdevice() which acquires a reference on the returned ndev via krefget(). On the path where the host queue backlog is exceeded and the function returns NVMESCCONNECTCTRLBUSY, reference of ndev is not released, leaking the kref.

Fix this by adding a goto to the existing putdevice label before the early return.

Affected Software

4 affected components
Linux Linux kernel
Linux Linux kernel>=6.8<6.12.96
Linux Linux kernel>=6.13<6.18.39
Linux Linux kernel>=6.19<7.1.4

Event History

Jul 25, 2026
CVE Published
via MITRE·08:49 AM
Data Sourced
via MITRE·08:49 AM
Description
Data Sourced
via NVD·10:17 AM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems using the Linux kernel NVMe target RDMA queue-connect path are exposed when host queue backlog limits can be exceeded. The issue occurs during connection handling for an NVMe RDMA target device.

2

What conditions are required to trigger the leak?

A queue-connect request must reach nvmet_rdma_queue_connect(), acquire an ndev reference, and then hit the host queue backlog-exceeded path that returns NVME_SC_CONNECT_CTRL_BUSY. Each occurrence on that path leaks the acquired device reference.

3

What is the operational impact if it is repeatedly triggered?

Repeated connections that exceed the host queue backlog can accumulate unreleased ndev references. The CVSS vector identifies availability impact only, with no confidentiality or integrity impact.

4

What can be done if the patch cannot be applied immediately?

The provided data identifies the backlog-exceeded queue-connect path as the trigger. Limiting or monitoring repeated queue connection attempts that receive controller-busy responses may reduce exposure until the available patch can be deployed.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203