Look up another CVE · open CVE-2026-64534 in the interactive tracker
CVE-2026-64534
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
Published 2026-07-27 (3 months ago) by the Linux kernel CNA. Subsystem drivers/nvme. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64534 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4720-1 · 2026-08-05 · text | 6.1.180-1 | Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6405-1 · 2026-07-31 · text | 6.12.100-1 | Update the kernel and reboot. DSA-6405-1 shipped the fix on 2026-07-31, in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4724-1 · 2026-08-07 · text | 6.12.100-1~deb12u1 | Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/nvme/target/tcp.c
- What this is
- NVM EXPRESS TARGET DRIVERMAINTAINERS section matched on drivers/nvme/target/ · linux-nvme@lists.infradead.org · Supported
- Kernel module
- nvmet_tcp
Check it on the machine
grep -w CONFIG_NVME_TARGET_TCP /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nvmet_tcpPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_NVME_TARGET_TCP
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-27 (3 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.42%, higher than 34.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/nvme
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.10.20 | 5.10.261 | 22ec7a9fe915 |
| 5.12 | 5.15.212 | ba35b1c674ca |
| 5.12 | 6.1.178 | c7874dad84b2 |
| 5.12 | 6.6.145 | e602c93b25bd |
| 5.12 | 6.12.97 | d306da8833e7 |
| 5.12 | 6.18.40 | 2ed3c9d955e8 |
| 5.12 | 7.1 | 4606467a75cf |
| 5.11.3 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4724-1 | 2026-08-07 | bookworm 6.12.100-1~deb12u1 | tracker |
| DLA-4723-1 | 2026-08-07 | bullseye 6.1.180-1~deb11u1 | tracker |
| DLA-4720-1 | 2026-08-05 | bookworm 6.1.180-1 | tracker |
| DLA-4717-1 | 2026-08-05 | bullseye 5.10.262-1 | tracker |
| DSA-6405-1 | 2026-07-31 | trixie 6.12.100-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerable NVMe/TCP target receive path processes attacker-supplied ICReq, CapsuleCmd, inline payload, and digest data over an Internet-routable TCP connection.
- AC:LAttack complexity, low
- The attacker can negotiate data digests and reliably send a rejected write command with inline data followed by an incorrect digest; no race or condition outside the attacker's control is required.
- PR:NPrivileges required, none
- A malformed CapsuleCmd can trigger this path before CONNECT, host-NQN ACL evaluation, or DH-HMAC-CHAP authentication, so the remote attacker needs no credentials or privileges.
- UI:NUser interaction, none
- The target processes the malicious protocol sequence automatically without any victim action.
- S:UScope, unchanged
- The vulnerable transport and the affected kernel memory, execution, and storage resources belong to the same target-host security authority.
- C:HConfidentiality impact, high
- The unmatched reference decrement can offset a legitimate in-flight request reference, allowing command structures and SGL pages to be freed while backend I/O still uses them; this UAF can expose arbitrary reused kernel memory.
- I:HIntegrity impact, high
- The premature freeing of request structures and I/O pages can let backend operations write through reallocated memory or corrupt completion control state, making arbitrary kernel writes and control-flow hijacking defensible.
- A:HAvailability impact, high
- The basic trigger causes a submission-queue refcount underflow and permanent workqueue deadlock, while UAF variants can crash the kernel; unauthenticated attackers can repeat the trigger across connections.