CVE-2026-64535
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In the NVMe/TCP subsystem of the Linux kernel, when a data digest mismatch occurs on a non-final H2C_DATA PDU, nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() without marking the command as completed. This leads to a double call to nvmet_req_uninit() during queue teardown, resulting in a double free and potential use-after-free (UAF).
Risk Assessment
A double free can lead to memory corruption and potentially arbitrary code execution by an attacker.
Recommendation
Apply the Linux kernel patch that ensures the command is properly marked as completed before calling nvmet_req_uninit() on digest error.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get.