CVE-2026-64535 - Vulnerability Details

- nvmet-tcp: Fix potential UAF when ddgst mismatch

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: Fix potential UAF when ddgst mismatch

Shivam Kumar found via vulnerability testing:
When data digest is enabled on an NVMe/TCP connection and a digest
mismatch occurs on a non-final H2C_DATA PDU during an R2T-based
data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()
calls nvmet_req_uninit() — which performs percpu_ref_put() on the
submission queue — but does NOT mark the command as completed. It
does not set cqe->status, does not modify rbytes_done, and does not
clear any flag. When the subsequent fatal error triggers queue
teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,
checks nvmet_tcp_need_data_in() for each one, and finds that the
already-uninited command still appears to need data (because
rbytes_done < transfer_len and cqe->status == 0). It therefore calls
nvmet_req_uninit() a second time on the same command — a double
percpu_ref_put against a single percpu_ref_get.

Published: 2026-07-27

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The nvmet‑tcp driver in the Linux kernel can double free a command reference when a data digest mismatch occurs on a non‑final H2C_DATA PDU during an R2T‑based transfer. This use‑after‑free (CWE-1341, CWE-415) causes kernel memory corruption that can destabilize the system, resulting in a crash or denial of service. The patch removes the erroneous nvmet_req_uninit() call. The consequence is restricted to the kernel and can affect any system running the vulnerable driver.

Affected Systems

All Linux kernel releases that ship the nvmet‑tcp driver with data‑digest validation enabled and have not incorporated the upstream patch. This includes most distributions that use the default kernel without the fix, regardless of architecture.

Risk and Exploitability

The CVSS score of 9.8 reflects the high severity of this kernel memory corruption flaw. The EPSS score of < 1% indicates a very low probability that an exploit will be used in the wild; the vulnerability is not listed in CISA's KEV catalog, meaning no publicly known exploit exists. The flaw is a double free that can be triggered by sending crafted NVMe/TCP packets that generate a digest mismatch, which requires the ability to negotiate an NVMe/TCP session with data‑digest enabled and inject packets. The attack vector is inferred to be through the NVMe/TCP protocol channel.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`91edfca6f8b364d60cde3ddefaf7d03ddf35774b`	affected	< dfb902462bca478f050224ec7a7195aafa7643b1
`fda871c0ba5d2eed2cd1c881573168129da70058`	affected	< 7e558308eba14c8136cb1e615f0c850f76d1fc0a
`fda871c0ba5d2eed2cd1c881573168129da70058`	affected	< 96fe2513df590e74b04253a45089cae75569570e
`fda871c0ba5d2eed2cd1c881573168129da70058`	affected	< e091ff83d962f9ed00d9bd70443676de9fe98bdc
`fda871c0ba5d2eed2cd1c881573168129da70058`	affected	< 6f9442983a3e4227afd1c83a5251ddbca585ea21
`fda871c0ba5d2eed2cd1c881573168129da70058`	affected	< 088ee46c18d99baef453afd74181dd40ade044ad
`fda871c0ba5d2eed2cd1c881573168129da70058`	affected	< dbbd07d0a7020b80f6a7028e561908f7b83b3d5a
`4b17476d809273617d3317fa0d4ae78aa488d760`	affected	—
`5.10.20`	affected	< 5.10.265
`5.11.3`	affected	< 5.12

Linux

affected

Version	Status	Constraints
`5.12`	affected	—
`0`	unaffected	< 5.12
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,96fe2513df590e74b04253a45089cae75569570e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e091ff83d962f9ed00d9bd70443676de9fe98bdc)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6f9442983a3e4227afd1c83a5251ddbca585ea21)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,088ee46c18d99baef453afd74181dd40ade044ad)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,dbbd07d0a7020b80f6a7028e561908f7b83b3d5a)`	affected	code_commit	—
`[0,6.1.178)`	affected	semver	—
`[0,6.6.145)`	affected	semver	—
`[0,6.12.97)`	affected	semver	—
`[0,6.18.40)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a kernel version that contains the upstream nvmet‑tcp patch.
If a kernel upgrade is not possible, disable data‑digest validation for NVMe/TCP connections to eliminate the mismatch trigger.
Monitor kernel logs for "digest mismatch" or related errors and check for stray pending commands during queue teardown before a system reboot.

Generated by OpenCVE AI on October 20, 2026 at 13:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6405-1	linux security update
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8816-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8816-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8816-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8816-4	Linux kernel (GKE) vulnerabilities
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8888-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8888-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9003-1	Linux kernel (NVIDIA) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00547.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/088ee46c18d99baef453afd74181dd40ade044ad
https://git.kernel.org/stable/c/6f9442983a3e4227afd1c83a5251ddbca585ea21
https://git.kernel.org/stable/c/7e558308eba14c8136cb1e615f0c850f76d1fc0a
https://git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e
https://git.kernel.org/stable/c/dbbd07d0a7020b80f6a7028e561908f7b83b3d5a
https://git.kernel.org/stable/c/dfb902462bca478f050224ec7a7195aafa7643b1
https://git.kernel.org/stable/c/e091ff83d962f9ed00d9bd70443676de9fe98bdc
https://nvd.nist.gov/vuln/detail/CVE-2026-64535
https://www.cve.org/CVERecord?id=CVE-2026-64535

History

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-415

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7e558308eba14c8136cb1e615f0c850f76d1fc0a https://git.kernel.org/stable/c/dfb902462bca478f050224ec7a7195aafa7643b1

Thu, 30 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Tue, 28 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://nvd.nist.gov/vuln/detail/CVE-2026-64535 https://www.cve.org/CVERecord?id=CVE-2026-64535
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 27 Jul 2026 07:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get.
Title		nvmet-tcp: Fix potential UAF when ddgst mismatch
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/088ee46c18d99baef453afd74181dd40ade044ad https://git.kernel.org/stable/c/6f9442983a3e4227afd1c83a5251ddbca585ea21 https://git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e https://git.kernel.org/stable/c/dbbd07d0a7020b80f6a7028e561908f7b83b3d5a https://git.kernel.org/stable/c/e091ff83d962f9ed00d9bd70443676de9fe98bdc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-27T06:32:34.859Z

Updated: 2026-10-19T20:48:39.004Z

Reserved: 2026-07-19T15:36:31.795Z

Link: CVE-2026-64535

Vulnrichment

Updated: 2026-10-16T15:41:56.591Z

NVD

Status : Awaiting Analysis

Published: 2026-07-27T08:16:22.773

Modified: 2026-11-03T18:15:39.353

Link: CVE-2026-64535

Redhat

Severity : Moderate

Publid Date: 2026-07-27T06:32:34Z

Links: CVE-2026-64535 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T13:45:13Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle
CWE-415
Double Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object