The Linux kernel's nvmet-tcp component had a vulnerability where, upon a data digest mismatch during an NVMe/TCP data transfer, the digest error handler called nvmet_req_uninit() without marking the command as completed. This omission caused the command to appear as still needing data, leading to a second call to nvmet_req_uninit() on the same command. This resulted in a double percpu_ref_put() call against a single percpu_ref_get(), constituting a use-after-free condition. The issue was discovered by Shivam Kumar via vulnerability testing and has been resolved in the kernel.

The vulnerability allows a use-after-free condition that can cause memory corruption within the kernel's NVMe/TCP subsystem. This can lead to system crashes, denial of service, or potentially arbitrary code execution, impacting confidentiality, integrity, and availability of the affected system.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch. Since no specific patch links or vendor advisories are provided, check the Linux kernel mailing lists or official kernel repositories for the relevant fix. No alternative mitigations are indicated.