{"id":"CVE-2026-74385","title":"nvmet-tcp: check return value of nvmet_tcp_set_queue_sock","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\n\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\nnvmet_tcp_tls_handshake_done(). If it …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 675b453e024154dd547921c6e6d5b58747ba7e0e < cba2ee57fd302727aea7d41e9d9cd0969f5df0fb","Linux >= 675b453e024154dd547921c6e6d5b58747ba7e0e < 22aa70f9a0544643ec37d442b6fcb1833d804462","Linux >= 675b453e024154dd547921c6e6d5b58747ba7e0e < 7ef789703e2b91775dcb36b2efa46325be31a2a0","Linux 6.7"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T18:55:01.310630Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:55:36.864Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74385","references":[{"url":"https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb"},{"url":"https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462"},{"url":"https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0"}],"tags":["cve.org"],"epss":0.00609,"epssPercentile":0.48084,"ingestedAt":"2026-10-16T19:46:24.373Z","slug":"CVE-2026-74385","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\n\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\nnvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket\nnot being in TCP_ESTABLISHED state), the socket callbacks will not be\nproperly set, leading to queue and socket leakage.\n\nFix this by capturing the return value and calling\nnvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup.\n\n## Affected\n\n- `Linux >= 675b453e024154dd547921c6e6d5b58747ba7e0e < cba2ee57fd302727aea7d41e9d9cd0969f5df0fb`\n- `Linux >= 675b453e024154dd547921c6e6d5b58747ba7e0e < 22aa70f9a0544643ec37d442b6fcb1833d804462`\n- `Linux >= 675b453e024154dd547921c6e6d5b58747ba7e0e < 7ef789703e2b91775dcb36b2efa46325be31a2a0`\n- `Linux 6.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}