CVE-2026-64535
A bug in the Linux kernel’s NVMe/TCP driver could let an attacker trigger a double free and crash the system. The flaw occurs when a data digest mismatch happens during a non‑final data transfer, causing the kernel to release a reference twice. The issue has been fixed in a kernel update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users that run NVMe/TCP with data digest enabled, across all distributions that have not yet applied the latest kernel update.
Real-world impact
An attacker who can send a crafted NVMe/TCP packet could cause the kernel to crash, leading to a denial‑of‑service or potentially allowing further exploitation if the crash occurs in a privileged context.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be triggered remotely without authentication, and it provides complete compromise of confidentiality, integrity, and availability.
What to do about it
- 011. Update your Linux kernel to a version that includes the nvmet-tcp patch.
- 022. Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Jul 27, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.