Bug 2507399 (CVE-2026-64534)

Summary: CVE-2026-64534 kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's NVMe over TCP (nvmet-tcp) implementation. When a data digest mismatch occurs, a reference count underflow can happen due to an unconditional cleanup call. This issue can lead to a use-after-free condition and ultimately result in a permanent workqueue deadlock, causing a Denial of Service (DoS) for the system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-27 08:01:22 UTC 
In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
nvmet_req_uninit() is called unconditionally. However, if the command
arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()
had returned false and percpu_ref_tryget_live() was never executed. The
unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a
refcount underflow, leading to a WARNING in
percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and
eventually a permanent workqueue deadlock.

Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling
nvmet_req_uninit(), matching the existing pattern in
nvmet_tcp_execute_request().
Comment 1 TEJ RATHI 2026-07-29 06:26:00 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026072734-CVE-2026-64534-434b@gregkh/T
Comment 4 Jon Orris 2026-09-22 19:30:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:70403 https://access.redhat.com/errata/RHSA-2026:70403
Comment 5 Jon Orris 2026-09-22 20:21:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:70402 https://access.redhat.com/errata/RHSA-2026:70402
Comment 6 Jon Orris 2026-09-23 03:55:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:70498 https://access.redhat.com/errata/RHSA-2026:70498
Comment 8 Jon Orris 2026-09-24 05:52:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:71232 https://access.redhat.com/errata/RHSA-2026:71232