CVE-2026-74386

A flaw was found in the nvmet-tcp component of the Linux kernel. A remote attacker could repeatedly open and close connections, causing a page fragment cache leak. This vulnerability occurs when a connection is closed during the allocation process, leading to memory not being properly released. Over time, this repeated memory leak could lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.

A page fragment cache leak in the NVMe TCP target queue allocation error path can occur when a connection is closed during nvmet_tcp_alloc_queue and the error path exits without draining queue pf_cache. A remote host on a reachable storage network can repeatedly open and close connections during allocation failure windows, causing leaked page fragments to accumulate over time and potentially exhaust kernel memory. For the CVSS the PR:N is used because no local account on the victim is required beyond reachability to the NVMe TCP target endpoint. The attack vector is treated as AV:A because NVMe TCP targets are normally deployed inside storage or data center networks rather than exposed to the public Internet. Impact is denial of service through memory exhaustion. There is no evidence of UAF, OOB access, arbitrary write, information disclosure, or privilege escalation in this patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.