CVE-2026-64535nvmet-tcp: Fix potential UAF when ddgst mismatch
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 91edfca6f8b364d60cde3ddefaf7d03ddf35774b before dfb902462bca478f050224ec7a7195aafa7643b1; from fda871c0ba5d2eed2cd1c881573168129da70058 before 7e558308eba14c8136cb1e615f0c850f76d1fc0a; from fda871c0ba5d2eed2cd1c881573168129da70058 before 96fe2513df590e74b04253a45089cae75569570e; from fda871c0ba5d2eed2cd1c881573168129da70058 before e091ff83d962f9ed00d9bd70443676de9fe98bdc; from fda871c0ba5d2eed2cd1c881573168129da70058 before 6f9442983a3e4227afd1c83a5251ddbca585ea21; from fda871c0ba5d2eed2cd1c881573168129da70058 before 088ee46c18d99baef453afd74181dd40ade044ad; from fda871c0ba5d2eed2cd1c881573168129da70058 before dbbd07d0a7020b80f6a7028e561908f7b83b3d5a; 4b17476d809273617d3317fa0d4ae78aa488d760; and 2 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/dfb902462bca478f050224ec7a7195aafa7643b1
- https://git.kernel.org/stable/c/7e558308eba14c8136cb1e615f0c850f76d1fc0a
- https://git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e
- https://git.kernel.org/stable/c/e091ff83d962f9ed00d9bd70443676de9fe98bdc
- https://git.kernel.org/stable/c/6f9442983a3e4227afd1c83a5251ddbca585ea21
- https://git.kernel.org/stable/c/088ee46c18d99baef453afd74181dd40ade044ad
- https://git.kernel.org/stable/c/dbbd07d0a7020b80f6a7028e561908f7b83b3d5a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.