CVE-2026-64534: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path
In nvmettcptryrecvddgst(), when a data digest mismatch is detected, nvmetrequninit() is called unconditionally. However, if the command arrived via the nvmettcphandlereqfailure() path, nvmetreqinit() had returned false and percpureftrygetlive() was never executed. The unconditional percpurefput() inside nvmetrequninit() then causes a refcount underflow, leading to a WARNING in percpurefswitchtoatomicrcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock.
Check cmd->flags & NVMETTCPFINITFAILED before calling nvmetrequninit(), matching the existing pattern in nvmettcpexecuterequest().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64534?
CVE-2026-64534 has been assigned a risk score of 53.
How does CVE-2026-64534 affect the Linux kernel?
CVE-2026-64534 involves a vulnerability in the Linux kernel's nvmet-tcp module related to improper handling of data digest mismatches.
What causes the vulnerability in CVE-2026-64534?
The vulnerability in CVE-2026-64534 is caused by calling nvmet_req_uninit() unconditionally, which can lead to a use-after-free scenario.
How do I fix CVE-2026-64534?
To fix CVE-2026-64534, ensure that your Linux kernel is updated to a version that includes the patch addressing this vulnerability.
Is CVE-2026-64534 exploitable?
CVE-2026-64534 could potentially be exploited due to the use-after-free condition, leading to denial of service or arbitrary code execution.