CVE-2026-64535

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: Fix potential UAF when ddgst mismatch

Shivam Kumar found via vulnerability testing:

When data digest is enabled on an NVMe/TCP connection and a digest

mismatch occurs on a non-final H2C_DATA PDU during an R2T-based

data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()

calls nvmet_req_uninit() — which performs percpu_ref_put() on the

submission queue — but does NOT mark the command as completed. It

does not set cqe->status, does not modify rbytes_done, and does not

clear any flag. When the subsequent fatal error triggers queue

teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,

checks nvmet_tcp_need_data_in() for each one, and finds that the

already-uninited command still appears to need data (because

rbytes_done < transfer_len and cqe->status == 0). It therefore calls

nvmet_req_uninit() a second time on the same command — a double

percpu_ref_put against a single percpu_ref_get.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References