CVE-2026-74386

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak exists in the nvmet-tcp module. In the nvmet tcp alloc queue() function, if a connection is closed during the allocation process (for example, when nvmet tcp set queue sock() returns -ENOTCONN), the error handling path fails to drain the page fragment cache. While nvmet tcp free cmd() may release individual page fragments, the page cache reference held by the pf cache variable is not released. This occurs because the first allocation using pf cache happens via nvmet tcp alloc cmd() after ida alloc() succeeds. Repeatedly opening and closing connections that fail during allocation can lead to memory exhaustion.

Recommendations Call the page frag cache drain() function before freeing the queue structure in the out ida remove label.