CVE-2026-64535 Linux CVE debrief

Who should care

Linux kernel users and administrators, NVMe/TCP connection users, security teams, and vulnerability management teams should review and address this vulnerability. Affected operators should verify deployments, assess potential impact, and apply patches or mitigations. Platform administrators should check for exposures, update compensating controls, and monitor logs for related errors. Vulnerability management teams should track exceptions, retest remediated assets, and ensure evidence is documented before closing the item.

Technical summary

The vulnerability is caused by the digest error handler in nvmet_tcp_try_recv_ddgst() not marking the command as completed when a digest mismatch occurs. This can lead to a double percpu_ref_put against a single percpu_ref_get. The vulnerability can be triggered when data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer. Linux kernel users should verify their deployments and apply the patch or recommended mitigations.

Defensive priority

High

Recommended defensive actions

• Apply the kernel patch to fix the vulnerability
• Disable data digest on NVMe/TCP connections
• Monitor kernel logs for errors related to nvmet-tcp
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was found via vulnerability testing by Shivam Kumar. The fix is available in the Linux kernel stable branch. Linux kernel users should verify their deployments and apply the patch or recommended mitigations. Evidence is limited to public CVE details and associated references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.