CVE-2026-74386

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fix page fragment cache leak in error path

In nvmet_tcp_alloc_queue(), when a connection is closed during the

allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN),

the error handling jumps to out_destroy_sq and then to out_ida_remove

without draining the page fragment cache.

Although nvmet_tcp_free_cmd() is called in some error paths to release

individual page fragments, the underlying page cache reference held by

queue->pf_cache is never released. The first allocation using pf_cache

is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens

after ida_alloc() returns successfully. This results in a page leak each

time a connection fails during allocation, which could lead to memory

exhaustion over time if connections are repeatedly opened and closed.

Fix this by calling page_frag_cache_drain() before freeing the queue

structure in the out_ida_remove label.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References