Skip to main content

Linux Kernel CVE-2026-64535

| EUVDEUVD-2026-49113 CRITICAL
2026-07-27 Linux GHSA-5wfv-mpg7-6vcr
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable NVMe/TCP target but requires ddgst enabled plus a mismatch on a non-final PDU mid-transfer (AC:H); impact is a kernel double-free crash, so A:H with C/I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
6.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 30, 2026 - 06:46 vuln.today
CVSS changed
Jul 30, 2026 - 06:37 NVD
9.8 (CRITICAL)
Patch available
Jul 27, 2026 - 09:01 EUVD
CVE Published
Jul 27, 2026 - 06:32 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 06:32 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: Fix potential UAF when ddgst mismatch

Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() - which performs percpu_ref_put() on the submission queue - but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command - a double percpu_ref_put against a single percpu_ref_get.

AnalysisAI

Local denial-of-service (kernel double-free/UAF) in the Linux kernel NVMe/TCP target driver (nvmet-tcp) affects hosts serving block storage over NVMe-over-TCP with data digest enabled. When a data-digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based transfer, the command is uninited but not marked complete, so queue teardown uninits it a second time, causing a double percpu_ref_put against a single get. There is no public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the flaw is not in CISA KEV.

Technical ContextAI

The affected component is nvmet-tcp, the Linux kernel's NVMe-over-TCP storage *target* (server) implementation that exposes block devices to remote initiators over TCP. The bug lives in the receive path for data digests (ddgst): NVMe/TCP optionally appends a CRC32C digest to PDUs, and nvmet_tcp_try_recv_ddgst() handles a mismatch by calling nvmet_req_uninit(), which does a percpu_ref_put() on the submission queue reference. Because that error path fails to set cqe->status, advance rbytes_done, or clear the data-in flag, nvmet_tcp_need_data_in() later still reports the command as needing data, so nvmet_tcp_uninit_data_in_cmds() re-uninits it during queue teardown. The result is a reference-count imbalance (double put vs. single get) - a classic use-after-free / object-lifetime bug (CWE-416/CWE-415 class; the input lists CWE as N/A). Per EUVD CPE the affected product is the mainline Linux kernel (cpe:2.3:a:linux:linux).

RemediationAI

Vendor-released patch: upgrade to a fixed Linux kernel - 6.1.178, 6.6.145, 6.12.97, or 6.18.40 or later (fix also present in the 7.1 line) - matching your stable series; the upstream commits are available at git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e and the related commits (e091ff83d962, 6f9442983a3e, 088ee46c18d9, dbbd07d0a702). If you cannot patch immediately, the most direct compensating control is to disable data digest on NVMe/TCP target configurations (the mismatch handler is the trigger), which avoids the vulnerable code path at the cost of losing end-to-end data-integrity checking on the wire. Alternatively, if the NVMe-over-TCP target role is not required, unload/disable the nvmet-tcp module, or restrict network reachability of the NVMe/TCP port (default TCP 4420) to trusted initiators only via firewalling and dedicated storage VLANs - this reduces exposure but does not fix the bug for authorized initiators. Track vendor guidance via the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-64535) and your distribution's kernel advisories.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64535 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy