---
id: CVE-2026-64534
title: 'nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

  In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
  nvmet_req_uninit() is…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 91edfca6f8b364d60cde3ddefaf7d03ddf35774b <
    22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    c7874dad84b20433c0fe3919f291a762d40de08b
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    d306da8833e75f669d93424fd84940236f3850bc
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    2ed3c9d955e8cd6361f130623baa664a75fb345f
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    4606467a75cfc16721937272ed29462a750b60c8
  - Linux 4b17476d809273617d3317fa0d4ae78aa488d760
  - Linux >= 5.10.20 < 5.10.261
  - Linux >= 5.11.3 < 5.12
  - Linux 5.12
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:41:53.789221Z'
published: '2026-07-27'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:40.408Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64534'
references:
  - url: 'https://git.kernel.org/stable/c/22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf'
  - url: 'https://git.kernel.org/stable/c/ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e'
  - url: 'https://git.kernel.org/stable/c/c7874dad84b20433c0fe3919f291a762d40de08b'
  - url: 'https://git.kernel.org/stable/c/e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1'
  - url: 'https://git.kernel.org/stable/c/d306da8833e75f669d93424fd84940236f3850bc'
  - url: 'https://git.kernel.org/stable/c/2ed3c9d955e8cd6361f130623baa664a75fb345f'
  - url: 'https://git.kernel.org/stable/c/4606467a75cfc16721937272ed29462a750b60c8'
tags:
  - cve.org
epss: 0.00419
epssPercentile: 0.34684
ingestedAt: '2026-10-16T17:24:46.827Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
nvmet_req_uninit() is called unconditionally. However, if the command
arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()
had returned false and percpu_ref_tryget_live() was never executed. The
unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a
refcount underflow, leading to a WARNING in
percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and
eventually a permanent workqueue deadlock.

Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling
nvmet_req_uninit(), matching the existing pattern in
nvmet_tcp_execute_request().

## Affected

- `Linux >= 91edfca6f8b364d60cde3ddefaf7d03ddf35774b < 22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < c7874dad84b20433c0fe3919f291a762d40de08b`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < d306da8833e75f669d93424fd84940236f3850bc`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < 2ed3c9d955e8cd6361f130623baa664a75fb345f`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < 4606467a75cfc16721937272ed29462a750b60c8`
- `Linux 4b17476d809273617d3317fa0d4ae78aa488d760`
- `Linux >= 5.10.20 < 5.10.261`
- `Linux >= 5.11.3 < 5.12`
- `Linux 5.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.