In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via… (CVE-2026-64535)
A use-after-free (UAF) vulnerability was identified and resolved in the Linux kernel's nvmet-tcp module. The flaw occurs when data digest is enabled on an NVMe/TCP connection and a digest mismatch happens during a non-final H2C_DATA PDU in an R2T-based data transfer. The error handler improperly calls a cleanup function twice on the same command, leading to a double release of a reference counter. This can cause memory corruption and potentially lead to system instability or compromise. The vulnerability is rated critical due to its impact on confidentiality, integrity, and availability.
AI Analysis
Technical Summary
The Linux kernel's nvmet-tcp component had a vulnerability where, upon a data digest mismatch during an NVMe/TCP data transfer, the digest error handler called nvmet_req_uninit() without marking the command as completed. This omission caused the command to appear as still needing data, leading to a second call to nvmet_req_uninit() on the same command. This resulted in a double percpu_ref_put() call against a single percpu_ref_get(), constituting a use-after-free condition. The issue was discovered by Shivam Kumar via vulnerability testing and has been resolved in the kernel.
Potential Impact
The vulnerability allows a use-after-free condition that can cause memory corruption within the kernel's NVMe/TCP subsystem. This can lead to system crashes, denial of service, or potentially arbitrary code execution, impacting confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch. Since no specific patch links or vendor advisories are provided, check the Linux kernel mailing lists or official kernel repositories for the relevant fix. No alternative mitigations are indicated.
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via… (CVE-2026-64535)
Description
A use-after-free (UAF) vulnerability was identified and resolved in the Linux kernel's nvmet-tcp module. The flaw occurs when data digest is enabled on an NVMe/TCP connection and a digest mismatch happens during a non-final H2C_DATA PDU in an R2T-based data transfer. The error handler improperly calls a cleanup function twice on the same command, leading to a double release of a reference counter. This can cause memory corruption and potentially lead to system instability or compromise. The vulnerability is rated critical due to its impact on confidentiality, integrity, and availability.
CVSS v3.1
Score 9.8critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's nvmet-tcp component had a vulnerability where, upon a data digest mismatch during an NVMe/TCP data transfer, the digest error handler called nvmet_req_uninit() without marking the command as completed. This omission caused the command to appear as still needing data, leading to a second call to nvmet_req_uninit() on the same command. This resulted in a double percpu_ref_put() call against a single percpu_ref_get(), constituting a use-after-free condition. The issue was discovered by Shivam Kumar via vulnerability testing and has been resolved in the kernel.
Potential Impact
The vulnerability allows a use-after-free condition that can cause memory corruption within the kernel's NVMe/TCP subsystem. This can lead to system crashes, denial of service, or potentially arbitrary code execution, impacting confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch. Since no specific patch links or vendor advisories are provided, check the Linux kernel mailing lists or official kernel repositories for the relevant fix. No alternative mitigations are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5wfv-mpg7-6vcr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64535"]
- Ecosystems
- []
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a6b72d09c2644c7f8476dab
Added to database: 07/30/2026, 15:50:40 UTC
Last enriched: 07/30/2026, 19:23:41 UTC
Last updated: 07/31/2026, 20:17:48 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.