CVE-2026-64535

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the nvmet-tcp module. When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C DATA PDU during an R2T-based data transfer, the error handler in the nvmet tcp try recv ddgst() function calls nvmet req uninit(), which performs a percpu ref put() on the submission queue without marking the command as completed. Consequently, during queue teardown, the nvmet tcp uninit data in cmds() function identifies the command as still needing data via nvmet tcp need data in() and calls nvmet req uninit() a second time. This results in a double percpu ref put against a single percpu ref get.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.