CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: fix page fragment cache leak in error path
In nvmettcpallocqueue(), when a connection is closed during the allocation process (e.g., nvmettcpsetqueuesock() returns -ENOTCONN), the error handling jumps to outdestroysq and then to outidaremove without draining the page fragment cache.
Although nvmettcpfreecmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pfcache is never released. The first allocation using pfcache is the call to nvmettcpalloccmd() for queue->connect, which happens after idaalloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed.
Fix this by calling pagefragcachedrain() before freeing the queue structure in the outidaremove label.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Patch nvmet-tcp so that page fragment cache (queue->pf_cache) is drained/released before freeing the queue in the allocation error path (e.g., when nvmet_tcp_set_queue_sock() returns -ENOTCONN).
Linux kernel nvmet-tcp Error-path handling = page_frag_cache_drain() before queue free - Compensating control
Call page_frag_cache_drain() before freeing the queue in the error path where nvmet_tcp_free_cmd() is invoked (e.g., when a connection is closed during nvmet_tcp_alloc_queue() and the flow jumps to out_destroy_sq and then to out_ida_remove).