CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create()
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix refcount leak in nvmetsqcreate()
In nvmetsqcreate(), a reference on the ctrl is taken via krefgetunlesszero() before calling nvmetchecksqid(). If nvmetchecksqid() fails, the function returns the error directly without releasing the reference, leading to a leak.
Fix this by jumping to the "ctrlput" label, which already performs the necessary nvmetctrlput(ctrl). This ensures the reference is properly released on this error path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72128?
CVE-2026-72128 has a risk score of 12, indicating a high severity vulnerability.
How do I fix CVE-2026-72128?
To fix CVE-2026-72128, ensure you update your Linux kernel to the patched version released after August 15, 2026.
What does CVE-2026-72128 affect?
CVE-2026-72128 affects the nvmet subsystem in the Linux kernel that deals with NVMe over Fabrics.
What is the nature of the vulnerability in CVE-2026-72128?
CVE-2026-72128 is a reference count leak in the nvmet_sq_create() function within the Linux kernel.
What are the potential consequences of CVE-2026-72128?
The consequences of CVE-2026-72128 could lead to memory leaks, which may degrade system performance or cause instability.