CVE-2026-64535: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64535 is a use-after-free (UAF) vulnerability in the Linux kernel's nvmet-tcp module, triggered by a data digest mismatch on NVMe/TCP connections with digest validation enabled. Discovered by Shivam Kumar via vulnerability testing and disclosed on July 27, 2026, it affects Linux kernel versions prior to 6.1.178, 6.6.145, 6.12.97, and 6.18.40. The vulnerability arises when nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() without marking the command as completed, leading to a double percpu_ref_put during queue teardown. It carries a CVSS category estimate of Medium (GitHub Advisory, Feedly).

The root cause is improper state management in the nvmet_tcp_try_recv_ddgst() error handler (CWE classification not formally assigned). When a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based transfer, the handler calls nvmet_req_uninit() — performing a percpu_ref_put() on the submission queue — but fails to set cqe->status, update rbytes_done, or clear relevant flags. Consequently, during subsequent fatal error-triggered queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands and, finding the already-uninited command still appearing to need data (rbytes_done < transfer_len and cqe->status == 0), calls nvmet_req_uninit() a second time — resulting in a double percpu_ref_put against a single percpu_ref_get, constituting a use-after-free condition (GitHub Advisory).

Successful exploitation can lead to kernel memory corruption due to the double percpu_ref_put, potentially enabling local or network-adjacent code execution at the kernel level. An attacker who can trigger a data digest mismatch on an NVMe/TCP connection with digest validation enabled may corrupt kernel memory structures, leading to system instability, privilege escalation, or arbitrary code execution. The affected asset scope is limited to Linux systems running the nvmet-tcp kernel module with data digest validation enabled (Feedly).

1. Reconnaissance: Identify Linux systems exposing NVMe/TCP target (nvmet-tcp) services on the network, typically on TCP port 4420, with data digest validation (ddgst) enabled in the NVMe subsystem configuration.
2. Establish NVMe/TCP connection: Connect to the target NVMe/TCP service as an initiator, negotiating a connection with data digest enabled (e.g., using nvme-cli with digest options).
3. Initiate R2T-based data transfer: Send a write command large enough to trigger an R2T (Ready to Transfer) flow, causing the target to issue R2T PDUs and expect H2C_DATA PDUs in response.
4. Inject malformed H2C_DATA PDU: Send a non-final H2C_DATA PDU with a deliberately incorrect data digest value, triggering a digest mismatch in nvmet_tcp_try_recv_ddgst() and causing nvmet_req_uninit() to be called without completing the command.
5. Trigger queue teardown: Cause a fatal error on the connection (e.g., by abruptly closing it), prompting nvmet_tcp_uninit_data_in_cmds() to iterate commands and call nvmet_req_uninit() a second time on the already-uninited command.
6. Exploit UAF condition: Leverage the resulting double percpu_ref_put and kernel memory corruption to achieve privilege escalation or code execution, depending on kernel heap layout and available exploitation primitives (GitHub Advisory).

• Network: Unexpected or malformed NVMe/TCP traffic on TCP port 4420, particularly H2C_DATA PDUs with invalid data digests; repeated connection attempts followed by abrupt disconnections targeting nvmet-tcp services.
• Logs: Kernel logs (dmesg / /var/log/kern.log) showing percpu_ref warnings, use-after-free reports, or kernel BUG/OOPS traces originating from nvmet_tcp_try_recv_ddgst() or nvmet_tcp_uninit_data_in_cmds().
• Process/System: Unexpected kernel panics or system instability on hosts running nvmet-tcp with digest validation enabled; anomalous privilege escalation events following NVMe/TCP connection errors.

Patches have been backported to stable kernel releases: upgrade to Linux kernel 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1+ to resolve the vulnerability. The specific fix commits are 96fe2513, e091ff83, 6f944298, 088ee46c, and dbbd07d0 on the stable kernel trees (GitHub Advisory). As an interim workaround where patching is not immediately possible, disable NVMe/TCP data digest validation on the target configuration (noting this reduces data integrity protection), and restrict network access to NVMe/TCP services (TCP port 4420) to trusted hosts only using firewall rules.