CVE-2026-64321 is a vulnerability in the Linux kernel NVMe target RDMA implementation where a reference count (kref) leak occurs during queue connection. Specifically, nvmet_rdma_queue_connect() acquires a reference on a device object via nvmet_rdma_find_get_device() but fails to release it if the host queue backlog is exceeded and the function returns NVME_SC_CONNECT_CTRL_BUSY. This leak can lead to resource exhaustion over time. The vulnerability has been resolved by adding a goto statement to the existing put_device label to ensure the reference is released before the early return.

The vulnerability causes a reference count leak in kernel memory management related to NVMe RDMA target queue connections. While it does not directly allow code execution or privilege escalation, the leak can lead to resource exhaustion, potentially degrading system stability or causing denial of service if exploited over time.

A fix has been implemented in the Linux kernel source code to address this reference count leak by ensuring proper release of the device reference on early return. Users should apply the official kernel updates or patches that include this fix once available. Patch status is not explicitly stated in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.