CVE-2026-64535
CVE CVE-2026-64535EUVD EUVD-2026-49113Published 2026-07-27T06:32:34.000ZLast changed 2026-08-05T12:42:45.000ZCVSS 9.8
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux fda871c0ba5d2eed2cd1c881573168129da70058 <dbbd07d0a7020b80f6a7028e561908f7b83b3d5a; 5.10.20 <5.11; 91edfca6f8b364d60cde3ddefaf7d03ddf35774b; patch: 6.18.40; fda871c0ba5d2eed2cd1c881573168129da70058 <088ee46c18d99baef453afd74181dd40ade044ad; patch: 0; 5.11.3 <5.12; fda871c0ba5d2eed2cd1c881573168129da70058 <e091ff83d962f9ed00d9bd70443676de9fe98bdc; fda871c0ba5d2eed2cd1c881573168129da70058 <96fe2513df590e74b04253a45089cae75569570e; patch: 7.1; 5.12; patch: 6.1.178; patch: 6.6.145; patch: 6.12.97; 4b17476d809273617d3317fa0d4ae78aa488d760; fda871c0ba5d2eed2cd1c881573168129da70058 <6f9442983a3e4227afd1c83a5251ddbca585ea21
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.