CVE-2026-64534
A critical bug in the Linux kernel’s NVMe over TCP implementation can cause a reference‑count underflow, leading to a warning, use‑after‑free, and a permanent workqueue deadlock. The flaw occurs when a data‑digest mismatch is detected and the request cleanup is performed without checking if initialization failed. The issue has been fixed in the kernel.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, specifically the NVMe over TCP (nvmet‑tcp) subsystem. Users running kernel versions before the fix are affected, including servers and systems that use NVMe over TCP for storage.
Real-world impact
An attacker could trigger a permanent deadlock in the kernel’s workqueue, potentially causing a denial of service by halting system operations. The vulnerability could also lead to a use‑after‑free condition, which might be exploitable for arbitrary code execution if combined with other weaknesses.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network with no authentication or user interaction, and it can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the nvmet-tcp fix.
NVD description indicates the vulnerability has been resolved.
Timeline
- Jul 27, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/22ec7a9fe9153d2737…
- git.kernel.org/stable/c/2ed3c9d955e8cd6361…
- git.kernel.org/stable/c/4606467a75cfc16721…
- git.kernel.org/stable/c/ba35b1c674ca3841c0…
- git.kernel.org/stable/c/c7874dad84b20433c0…
- git.kernel.org/stable/c/d306da8833e75f669d…
- git.kernel.org/stable/c/e602c93b25bda4a9d0…