CVE-2026-64534 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and ensure their systems are updated with the latest kernel patches. This vulnerability has a high impact on Linux kernel deployments, particularly those using nvmet-tcp. Users should review system logs for signs of nvmet-tcp errors or workqueue deadlocks.

Technical summary

The vulnerability is in nvmet-tcp, specifically in the handling of data digest errors. When a mismatch is detected, nvmet_req_uninit() is called without checking if the request initialization failed. This can lead to a reference count underflow and potentially cause a permanent workqueue deadlock. The issue arises from the unconditional call to nvmet_req_uninit() in nvmet_tcp_try_recv_ddgst(). Linux kernel users should verify their systems are updated with the latest kernel patches to address this vulnerability, particularly those using nvmet-tcp, and review system logs for signs of nvmet-tcp errors or workqueue deadlocks.

Defensive priority

High priority for Linux kernel maintainers and users due to potential for denial of service and workqueue deadlocks.

Recommended defensive actions

• Apply the latest Linux kernel patches to ensure nvmet-tcp vulnerability is addressed.
• Review system logs for signs of nvmet-tcp errors or workqueue deadlocks.
• Consider implementing compensating controls for monitoring kernel updates and alerts.
• Verify Linux kernel versions and update if necessary.
• Monitor for potential denial of service attacks.
• Review nvmet-tcp configuration and implementation.
• Track Linux kernel security advisories and updates.

Evidence notes

Evidence is based on official CVE and NVD records, as well as Linux kernel source code references. The vulnerability was resolved in the Linux kernel's nvmet-tcp module. The issue involves a data digest mismatch detection in nvmet_tcp_try_recv_ddgst(), leading to an unconditional call to nvmet_req_uninit(). This causes a refcount underflow if the command arrived via nvmet_tcp_handle_req_failure() path and nvmet_req_init() returned false. Linux kernel users should verify their systems are updated with the latest kernel patches.

Official resources