CVE-2026-64534

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the nvmet-tcp module, the function nvmet tcp try recv ddgst() unconditionally calls nvmet req uninit() when a data digest mismatch is detected. If the command was processed via the nvmet tcp handle req failure() path, nvmet req init() returns false, meaning percpu ref tryget live() is not executed. This results in an unconditional percpu ref put() within nvmet req uninit(), causing a refcount underflow. This sequence leads to a warning in percpu ref switch to atomic rcu, a use-after-free diagnostic (a condition where the system attempts to access memory after it has been released), and a permanent workqueue deadlock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.