CVE-2026-64534
Description
A flaw was found in the Linux kernel's NVMe over TCP target (nvmet-tcp) implementation. When a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally, but if the command was already in the INIT_FAILED state, the matching percpu_ref_tryget_live() was never performed. The resulting percpu_ref_put() underflows the reference counter, which can lead to premature freeing of the referenced object (use-after-free) and a permanent workqueue deadlock. A remote attacker with access to the NVMe/TCP target can exploit this by sending a packet with an invalid data digest to crash the target (Denial of Service), with potential for memory corruption through the refcount underflow.
Mitigation
If NVMe over TCP target functionality is not required, the vulnerable code path can be avoided by not loading or by blacklisting the nvmet-tcp kernel module. For systems where NVMe/TCP targets are needed, restrict access to trusted initiators via host NQN allowlists and network segmentation to reduce the attack surface.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 9.8 |
| Attack Vector | Adjacent Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
