CVE-2026-64535
Description
A use-after-free flaw was found in the Linux kernel's NVMe-over-Fabrics TCP target (nvmet-tcp) driver. When NVMe/TCP data digest is enabled and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based write transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit(), which drops a percpu_ref reference on the submission queue without marking the command as completed. During the subsequent queue teardown, the same command is treated as still needing data and nvmet_req_uninit() is called a second time, resulting in a double percpu_ref_put against a single percpu_ref_get. This use-after-free and reference-count underflow can crash the kernel (denial of service) when a remote NVMe/TCP initiator triggers a digest mismatch against a host configured as an NVMe/TCP target.
Statement
This flaw is a use-after-free and reference-count underflow in the Linux kernel's NVMe-over-Fabrics TCP target driver (nvmet-tcp). When NVMe/TCP data digest is enabled and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based write transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit(), which drops a percpu_ref reference on the submission queue without marking the command as completed. During the subsequent queue teardown, the same command is still treated as needing data and nvmet_req_uninit() is called a second time, causing a double percpu_ref_put against a single percpu_ref_get. This can lead to a use-after-free and crash the kernel (denial of service).
This flaw is only reachable on systems that have been explicitly and manually configured to act as an NVMe-over-Fabrics TCP target (nvmet-tcp), for example by using the nvmetcli tool to export local block devices as an NVMe subsystem over a TCP network. Red Hat does not support the NVMe Target (nvmet) functionality in Red Hat Enterprise Linux; nvmet-tcp shipped as Technology Preview starting in RHEL 7.6 and continues to ship as Unmaintained in RHEL 8 and RHEL 9 and later. The NVMe/TCP host/initiator driver (nvme_tcp), which is fully supported for connecting to external NVMe/TCP storage, does not contain the affected code path and is not impacted by this issue. Systems that have not explicitly configured themselves as an NVMe/TCP target are not exposed to this vulnerability.
Red Hat Enterprise Linux 6 does not ship any NVMe-over-Fabrics support (host or target) and is not affected. Red Hat Enterprise Linux 7's Technology Preview nvmet-tcp module is frozen at an older upstream baseline that predates the vulnerable code path introduced by this flaw, so RHEL 7 is also not affected, consistent with Red Hat's disposition on two prior nvmet-tcp vulnerabilities (CVE-2026-22998, CVE-2026-46135).
Exploitation requires the attacking NVMe/TCP initiator to already have network access to a deliberately configured, unsupported NVMe/TCP target, which is typically reachable only from the same storage or data-center network segment rather than from the public Internet. Accordingly, the attack vector has been scored as Adjacent (AV:A) rather than Network (AV:N), consistent with Red Hat's CVSS treatment of the two prior nvmet-tcp CVEs referenced above.
Mitigation
There is no mitigation for this issue other than applying the kernel update once available. Because Red Hat does not support and does not enable the nvmet-tcp target functionality by default, systems that have not been explicitly configured with nvmetcli to act as an NVMe-over-Fabrics TCP target are not exposed and require no immediate action. Administrators who have deliberately configured an NVMe/TCP target using this unsupported functionality should restrict network access to the target port to trusted initiators on the same storage network only, and should consider disabling NVMe/TCP data digest or migrating off nvmet-tcp given its unmaintained status, until the fix is applied.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 9.8 |
| Attack Vector | Adjacent Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Re-scored per precedent (CVE-2026-22998, CVE-2026-46135): nvmet-tcp target deployments are on isolated storage/data-center networks, not Internet-facing, matching AV:A used on prior nvmet-tcp CVEs.
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
