CVE-2026-74386 - Vulnerability Details

- nvmet-tcp: fix page fragment cache leak in error path

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fix page fragment cache leak in error path

In nvmet_tcp_alloc_queue(), when a connection is closed during the
allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN),
the error handling jumps to out_destroy_sq and then to out_ida_remove
without draining the page fragment cache.

Although nvmet_tcp_free_cmd() is called in some error paths to release
individual page fragments, the underlying page cache reference held by
queue->pf_cache is never released. The first allocation using pf_cache
is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens
after ida_alloc() returns successfully. This results in a page leak each
time a connection fails during allocation, which could lead to memory
exhaustion over time if connections are repeatedly opened and closed.

Fix this by calling page_frag_cache_drain() before freeing the queue
structure in the out_ida_remove label.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s nvmet_tcp module, a bug caused page fragments allocated during connection setup to remain cached when a connection is aborted. Each failed connection retained a reference to page cache entries, producing a memory leak that could grow over time. The violation of resource integrity leads to potential exhaustion of system memory, ultimately reducing availability of the affected infrastructure.

Affected Systems

The vulnerability affects the nvmet_tcp component of the Linux kernel. All Linux kernel deployments that include the NVMe‑over‑TCP driver are susceptible; no specific kernel version is listed, so any kernel that has not yet received the patch is at risk.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker who can repeatedly open and close NVMe‑over‑TCP connections could force memory exhaustion. The attack vector is inferred as remote, originating from a client that initiates and aborts connections to the target device.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`872d26a391da92ed8f0c0f5cb5fef428067b7f30`	affected	< a43a9abc1ebf663f0aa56a729106f68dd9c77da6
`872d26a391da92ed8f0c0f5cb5fef428067b7f30`	affected	< ba3209704b3cd46961e4e081af5c52a780785648
`872d26a391da92ed8f0c0f5cb5fef428067b7f30`	affected	< 5fbe83a374f09561a0f0c1f4aa021501ffd681eb
`872d26a391da92ed8f0c0f5cb5fef428067b7f30`	affected	< 4dae393956093c807212918fd91a8fc70df15338

Linux

affected

Version	Status	Constraints
`5.0`	affected	—
`0`	unaffected	< 5.0
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[872d26a391da92ed8f0c0f5cb5fef428067b7f30,a43a9abc1ebf663f0aa56a729106f68dd9c77da6)`	affected	code_commit	—
`[872d26a391da92ed8f0c0f5cb5fef428067b7f30,ba3209704b3cd46961e4e081af5c52a780785648)`	affected	code_commit	—
`[872d26a391da92ed8f0c0f5cb5fef428067b7f30,5fbe83a374f09561a0f0c1f4aa021501ffd681eb)`	affected	code_commit	—
`[872d26a391da92ed8f0c0f5cb5fef428067b7f30,4dae393956093c807212918fd91a8fc70df15338)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.0`	affected	generic	—
`[0,5.0)`	unaffected	generic	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the Linux kernel update that implements page_frag_cache_drain in nvmet_tcp
If an official kernel update is unavailable, disable the nvmet‑tcp driver or restrict its usage until the patch is applied
Apply the patch manually by cherry‑selecting the commit from the Linux kernel repository or by building a custom kernel that includes the fix

Generated by OpenCVE AI on August 22, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4dae393956093c807212918fd91a8fc70df15338
https://git.kernel.org/stable/c/5fbe83a374f09561a0f0c1f4aa021501ffd681eb
https://git.kernel.org/stable/c/a43a9abc1ebf663f0aa56a729106f68dd9c77da6
https://git.kernel.org/stable/c/ba3209704b3cd46961e4e081af5c52a780785648
https://lore.kernel.org/linux-cve-announce/2026081506-CVE-2026-74386-9fc4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74386
https://www.cve.org/CVERecord?id=CVE-2026-74386

History

Sat, 22 Aug 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026081506-CVE-2026-74386-9fc4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74386 https://www.cve.org/CVERecord?id=CVE-2026-74386
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmet_tcp_alloc_queue(), when a connection is closed during the allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), the error handling jumps to out_destroy_sq and then to out_ida_remove without draining the page fragment cache. Although nvmet_tcp_free_cmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pf_cache is never released. The first allocation using pf_cache is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens after ida_alloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed. Fix this by calling page_frag_cache_drain() before freeing the queue structure in the out_ida_remove label.
Title		nvmet-tcp: fix page fragment cache leak in error path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4dae393956093c807212918fd91a8fc70df15338 https://git.kernel.org/stable/c/5fbe83a374f09561a0f0c1f4aa021501ffd681eb https://git.kernel.org/stable/c/a43a9abc1ebf663f0aa56a729106f68dd9c77da6 https://git.kernel.org/stable/c/ba3209704b3cd46961e4e081af5c52a780785648

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:59:01.786Z

Updated: 2026-08-17T05:18:24.557Z

Reserved: 2026-08-15T05:44:03.890Z

Link: CVE-2026-74386

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:40.513

Modified: 2026-08-17T06:19:33.570

Link: CVE-2026-74386

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74386 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T01:30:17Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object