CVE-2026-64534

nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

State: Published
Severity: 9.8 Critical
Published: Jul 27, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock.

Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request().

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-667 Improper Locking

Affected Products

Product	Versions
LinuxLinux	91edfca6f8b364d60cde3ddefaf7d03ddf35774b to before 22ec7a9fe9153d2737ee9b2fa6d2e43a1491decfAffected fda871c0ba5d2eed2cd1c881573168129da70058 to before ba35b1c674ca3841c0dfadd698f2c1b3ec542d4eAffected fda871c0ba5d2eed2cd1c881573168129da70058 to before c7874dad84b20433c0fe3919f291a762d40de08bAffected fda871c0ba5d2eed2cd1c881573168129da70058 to before e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1Affected fda871c0ba5d2eed2cd1c881573168129da70058 to before d306da8833e75f669d93424fd84940236f3850bcAffected fda871c0ba5d2eed2cd1c881573168129da70058 to before 2ed3c9d955e8cd6361f130623baa664a75fb345fAffected fda871c0ba5d2eed2cd1c881573168129da70058 to before 4606467a75cfc16721937272ed29462a750b60c8Affected 4b17476d809273617d3317fa0d4ae78aa488d760Affected 5.10.20 to before 5.10.261Affected 5.11.3 to before 5.12Affected
LinuxLinux	5.12Affected before 5.12Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

91edfca6f8b364d60cde3ddefaf7d03ddf35774b to before 22ec7a9fe9153d2737ee9b2fa6d2e43a1491decfAffected
fda871c0ba5d2eed2cd1c881573168129da70058 to before ba35b1c674ca3841c0dfadd698f2c1b3ec542d4eAffected
fda871c0ba5d2eed2cd1c881573168129da70058 to before c7874dad84b20433c0fe3919f291a762d40de08bAffected
fda871c0ba5d2eed2cd1c881573168129da70058 to before e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1Affected
fda871c0ba5d2eed2cd1c881573168129da70058 to before d306da8833e75f669d93424fd84940236f3850bcAffected
fda871c0ba5d2eed2cd1c881573168129da70058 to before 2ed3c9d955e8cd6361f130623baa664a75fb345fAffected
fda871c0ba5d2eed2cd1c881573168129da70058 to before 4606467a75cfc16721937272ed29462a750b60c8Affected
4b17476d809273617d3317fa0d4ae78aa488d760Affected
5.10.20 to before 5.10.261Affected
5.11.3 to before 5.12Affected

LinuxLinux

5.12Affected
before 5.12Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.