---
id: CVE-2026-64535
title: 'nvmet-tcp: Fix potential UAF when ddgst mismatch'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvmet-tcp: Fix potential UAF when ddgst mismatch

  Shivam Kumar found via vulnerability testing:
  When data digest is enabled on an NVMe/TCP connection and a digest
  misma…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 91edfca6f8b364d60cde3ddefaf7d03ddf35774b <
    dfb902462bca478f050224ec7a7195aafa7643b1
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    7e558308eba14c8136cb1e615f0c850f76d1fc0a
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    96fe2513df590e74b04253a45089cae75569570e
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    e091ff83d962f9ed00d9bd70443676de9fe98bdc
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    6f9442983a3e4227afd1c83a5251ddbca585ea21
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    088ee46c18d99baef453afd74181dd40ade044ad
  - >-
    Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 <
    dbbd07d0a7020b80f6a7028e561908f7b83b3d5a
  - Linux 4b17476d809273617d3317fa0d4ae78aa488d760
  - Linux >= 5.10.20 < 5.10.265
  - Linux >= 5.11.3 < 5.12
  - Linux 5.12
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:41:56.047833Z'
published: '2026-07-27'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:40.573Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64535'
references:
  - url: 'https://git.kernel.org/stable/c/dfb902462bca478f050224ec7a7195aafa7643b1'
  - url: 'https://git.kernel.org/stable/c/7e558308eba14c8136cb1e615f0c850f76d1fc0a'
  - url: 'https://git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e'
  - url: 'https://git.kernel.org/stable/c/e091ff83d962f9ed00d9bd70443676de9fe98bdc'
  - url: 'https://git.kernel.org/stable/c/6f9442983a3e4227afd1c83a5251ddbca585ea21'
  - url: 'https://git.kernel.org/stable/c/088ee46c18d99baef453afd74181dd40ade044ad'
  - url: 'https://git.kernel.org/stable/c/dbbd07d0a7020b80f6a7028e561908f7b83b3d5a'
tags:
  - cve.org
epss: 0.00547
epssPercentile: 0.44643
ingestedAt: '2026-10-16T17:24:46.827Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: Fix potential UAF when ddgst mismatch

Shivam Kumar found via vulnerability testing:
When data digest is enabled on an NVMe/TCP connection and a digest
mismatch occurs on a non-final H2C_DATA PDU during an R2T-based
data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()
calls nvmet_req_uninit() — which performs percpu_ref_put() on the
submission queue — but does NOT mark the command as completed. It
does not set cqe->status, does not modify rbytes_done, and does not
clear any flag. When the subsequent fatal error triggers queue
teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,
checks nvmet_tcp_need_data_in() for each one, and finds that the
already-uninited command still appears to need data (because
rbytes_done < transfer_len and cqe->status == 0). It therefore calls
nvmet_req_uninit() a second time on the same command — a double
percpu_ref_put against a single percpu_ref_get.

## Affected

- `Linux >= 91edfca6f8b364d60cde3ddefaf7d03ddf35774b < dfb902462bca478f050224ec7a7195aafa7643b1`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < 7e558308eba14c8136cb1e615f0c850f76d1fc0a`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < 96fe2513df590e74b04253a45089cae75569570e`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < e091ff83d962f9ed00d9bd70443676de9fe98bdc`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < 6f9442983a3e4227afd1c83a5251ddbca585ea21`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < 088ee46c18d99baef453afd74181dd40ade044ad`
- `Linux >= fda871c0ba5d2eed2cd1c881573168129da70058 < dbbd07d0a7020b80f6a7028e561908f7b83b3d5a`
- `Linux 4b17476d809273617d3317fa0d4ae78aa488d760`
- `Linux >= 5.10.20 < 5.10.265`
- `Linux >= 5.11.3 < 5.12`
- `Linux 5.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.