CVE-2026-64534 - Vulnerability Details

- nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
nvmet_req_uninit() is called unconditionally. However, if the command
arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()
had returned false and percpu_ref_tryget_live() was never executed. The
unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a
refcount underflow, leading to a WARNING in
percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and
eventually a permanent workqueue deadlock.

Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling
nvmet_req_uninit(), matching the existing pattern in
nvmet_tcp_execute_request().

Published: 2026-07-27

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c7874dad84b20433c0fe3919f291a762d40de08b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d306da8833e75f669d93424fd84940236f3850bc
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 2ed3c9d955e8cd6361f130623baa664a75fb345f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4606467a75cfc16721937272ed29462a750b60c8
`0`	affected	< 5.10.261
`0`	affected	< 5.15.212
`0`	affected	< 6.1.178
`0`	affected	< 6.6.145
`0`	affected	< 6.12.97
`0`	affected	< 6.18.40

Linux

affected

Version	Status	Constraints
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c7874dad84b20433c0fe3919f291a762d40de08b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d306da8833e75f669d93424fd84940236f3850bc)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2ed3c9d955e8cd6361f130623baa664a75fb345f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4606467a75cfc16721937272ed29462a750b60c8)`	affected	code_commit	—
`[0,5.10.261)`	affected	semver	—
`[0,5.15.212)`	affected	semver	—
`[0,6.1.178)`	affected	semver	—
`[0,6.6.145)`	affected	semver	—
`[0,6.12.97)`	affected	semver	—
`[0,6.18.40)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00161.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf
https://git.kernel.org/stable/c/2ed3c9d955e8cd6361f130623baa664a75fb345f
https://git.kernel.org/stable/c/4606467a75cfc16721937272ed29462a750b60c8
https://git.kernel.org/stable/c/ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e
https://git.kernel.org/stable/c/c7874dad84b20433c0fe3919f291a762d40de08b
https://git.kernel.org/stable/c/d306da8833e75f669d93424fd84940236f3850bc
https://git.kernel.org/stable/c/e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1
https://lore.kernel.org/linux-cve-announce/2026072734-CVE-2026-64534-434b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64534
https://www.cve.org/CVERecord?id=CVE-2026-64534

History

Thu, 30 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026072734-CVE-2026-64534-434b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64534 https://www.cve.org/CVERecord?id=CVE-2026-64534
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Mon, 27 Jul 2026 07:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request().
Title		nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf https://git.kernel.org/stable/c/2ed3c9d955e8cd6361f130623baa664a75fb345f https://git.kernel.org/stable/c/4606467a75cfc16721937272ed29462a750b60c8 https://git.kernel.org/stable/c/ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e https://git.kernel.org/stable/c/c7874dad84b20433c0fe3919f291a762d40de08b https://git.kernel.org/stable/c/d306da8833e75f669d93424fd84940236f3850bc https://git.kernel.org/stable/c/e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-27T06:32:34.301Z

Updated: 2026-07-30T06:06:30.094Z

Reserved: 2026-07-19T15:36:31.795Z

Link: CVE-2026-64534

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-07-27T00:00:00Z

Links: CVE-2026-64534 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-27T08:30:11Z

Weaknesses

CWE-911
Improper Update of Reference Count

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object