Skip to main content

Linux Kernel CVE-2026-64321

| EUVDEUVD-2026-49033 MEDIUM
2026-07-25 Linux GHSA-727c-mjrq-h39g
Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to trigger the RDMA target queue path; no confidentiality or integrity impact from a reference count leak.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 04, 2026 - 13:40 vuln.today
tag: Information Disclosure removed
Analysis Generated
Sep 04, 2026 - 13:08 vuln.today
CVSS changed
Sep 04, 2026 - 13:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:49 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

nvme: target: rdma: fix ndev refcount leak on queue connect

nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() which acquires a reference on the returned ndev via kref_get(). On the path where the host queue backlog is exceeded and the function returns NVME_SC_CONNECT_CTRL_BUSY, reference of ndev is not released, leaking the kref.

Fix this by adding a goto to the existing put_device label before the early return.

AnalysisAI

Reference count leak in the Linux kernel NVMe-oF target RDMA subsystem causes local denial of service on affected storage servers. When nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() and the host queue backlog is exceeded (NVME_SC_CONNECT_CTRL_BUSY), the kref acquired by kref_get() is never released via the put_device cleanup path. Repeated triggering of this code path by a local low-privileged process causes progressive resource exhaustion, ultimately rendering the affected device unreclaimable and degrading availability. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile).

Technical ContextAI

The vulnerability resides in the Linux kernel's NVMe-over-Fabrics (NVMe-oF) target layer, specifically in the RDMA (Remote Direct Memory Access) transport implementation (drivers/nvme/target/rdma.c). The affected subsystem is used by storage servers exposing NVMe namespaces over InfiniBand or RoCE networks. The root cause is an improper reference count management (kref) error: nvmet_rdma_find_get_device() increments a kernel reference counter on the returned ndev, but on the early-return path for NVME_SC_CONNECT_CTRL_BUSY the corresponding kref_put() cleanup via the put_device label is bypassed. While no CWE is formally assigned, this is a classic resource lifecycle management error analogous to CWE-772 (Missing Release of Resource after Effective Lifetime). The fix is a one-line goto insertion to ensure the put_device cleanup label is always reached before early returns.

RemediationAI

Upgrade to a patched Linux kernel version: 6.12.96, 6.18.39, or 7.1.4 (or 7.2-rc1 for mainline tracking). The upstream fix commits are available at git.kernel.org/stable/c/d65fe42820b890a6a4644de0a95a812471f79ad3, a8803c4f0ac3fa7df5551bbb5a8800c434a94357, 5828517d17eda27f21d29ea14800c9e0a57bad11, and badc53620fe813b3a9f727ef9526f98567c2c898. Distribution kernels tracking these stable branches should receive the fix through normal update channels. As a compensating control for systems where immediate upgrade is not possible: unloading or disabling the nvmet-rdma kernel module (rmmod nvmet-rdma) eliminates the attack surface entirely, though this disables NVMe-oF RDMA target functionality. Restricting local shell access on dedicated NVMe target appliances limits the pool of users who can trigger the busy-backlog condition.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-64321 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy