CVE-2026-64535

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmet-tcp: Fix potential UAF when ddgst mismatch<br /> <br /> Shivam Kumar found via vulnerability testing:<br /> When data digest is enabled on an NVMe/TCP connection and a digest<br /> mismatch occurs on a non-final H2C_DATA PDU during an R2T-based<br /> data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()<br /> calls nvmet_req_uninit() — which performs percpu_ref_put() on the<br /> submission queue — but does NOT mark the command as completed. It<br /> does not set cqe-&gt;status, does not modify rbytes_done, and does not<br /> clear any flag. When the subsequent fatal error triggers queue<br /> teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,<br /> checks nvmet_tcp_need_data_in() for each one, and finds that the<br /> already-uninited command still appears to need data (because<br /> rbytes_done status == 0). It therefore calls<br /> nvmet_req_uninit() a second time on the same command — a double<br /> percpu_ref_put against a single percpu_ref_get.