CVE-2026-64534

A flaw was found in the Linux kernel's NVMe over TCP target (nvmet-tcp) implementation. When a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally, but if the command was already in the INIT_FAILED state, the matching percpu_ref_tryget_live() was never performed. The resulting percpu_ref_put() underflows the reference counter, which can lead to premature freeing of the referenced object (use-after-free) and a permanent workqueue deadlock. A remote attacker with access to the NVMe/TCP target can exploit this by sending a packet with an invalid data digest to crash the target (Denial of Service), with potential for memory corruption through the refcount underflow.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If NVMe over TCP target functionality is not required, the vulnerable code path can be avoided by not loading or by blacklisting the nvmet-tcp kernel module. For systems where NVMe/TCP targets are needed, restrict access to trusted initiators via host NQN allowlists and network segmentation to reduce the attack surface.