Strix
26.1K

CVE-2026-64534

CRITICALCVSS 9.8/10EPSS 0.38%

Last modified

CVE-2026-64534 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. EPSS estimates a 0.38% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request().

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.38%

31.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 91edfca6f8b364d60cde3ddefaf7d03ddf35774b, < 22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf; >= fda871c0ba5d2eed2cd1c881573168129da70058, < ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e; >= fda871c0ba5d2eed2cd1c881573168129da70058, < c7874dad84b20433c0fe3919f291a762d40de08b; >= fda871c0ba5d2eed2cd1c881573168129da70058, < e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1; >= fda871c0ba5d2eed2cd1c881573168129da70058, < d306da8833e75f669d93424fd84940236f3850bc; >= fda871c0ba5d2eed2cd1c881573168129da70058, < 2ed3c9d955e8cd6361f130623baa664a75fb345f; >= fda871c0ba5d2eed2cd1c881573168129da70058, < 4606467a75cfc16721937272ed29462a750b60c8; 4b17476d809273617d3317fa0d4ae78aa488d760; >= 5.10.20, < 5.10.261; >= 5.11.3, < 5.12
LinuxLinux5.12

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-64534?
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request().
How severe is CVE-2026-64534?
CVE-2026-64534 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.38% probability of exploitation in the next 30 days.
How do I fix CVE-2026-64534?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-64534?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST