Linux nvmet-rdma: device reference leaks whenever a queue connect is rejected as busy

Impact

nvmet_rdma_queue_connect() takes a reference on the RDMA device via nvmet_rdma_find_get_device(), but the path that rejects a connect with NVME_SC_CONNECT_CTRL_BUSY returns without releasing it. Every rejected connect attempt permanently pins the device, so an initiator that repeatedly exceeds the host queue backlog drives the refcount up without bound. The practical consequence is that the RDMA device can never be released: module unload and device teardown block, and the leak is driven by the remote side rather than by anything local. On a storage target fronting an InfiniBand or RoCE fabric shared across tenants, that means the target node cannot be cleanly serviced without a reboot.

Who can reach it

Any initiator that can reach the NVMe-oF RDMA target on the storage fabric and open connections faster than the target accepts them. NVMe-oF targets are commonly exported without authentication on a trusted storage VLAN.

What to do

Update to a stable kernel carrying the fix and reboot each target node; the kernel CNA published four stable commits and no fixed version string, so match the commits below to your branch. Restricting which hosts can reach the target on the fabric limits who can drive the leak in the meantime.

References

Related entries

• Linux kernel BPF verifier: map-in-map lookup nullness elided using the wrong max_entriesCVE-2026-64353 · Linux kernel BPF verifier (ARRAY_OF_MAPS with BPF_F_INNER_MAP inner arrays)Medium
• Linux mm/swap: full-cluster reclaim runs without rescheduling and softlocks large-core-count hostsCVE-2026-64415 · Linux kernel mm/swap (swap_reclaim_full_clusters, missing cond_resched)Medium
• Linux mm: NULL dereference in lookup_swap_cgroup_id panics swapless hosts at process exitCVE-2026-64416 · Linux kernel mm swap_cgroup (lookup_swap_cgroup_id on hosts with no swap)Medium
• Linux io_uring: NOP with IOSQE_FIXED_FILE leaks a struct file reference on every submissionCVE-2026-64426 · Linux kernel io_uring NOP opcode (IOSQE_FIXED_FILE handling)Medium
• Linux kernel (drivers/vfio/pci): The disable_idle_d3 power-management flag was a module-wide global that could changeCVE-2026-64476 · Linux kernel (drivers/vfio/pci)Medium
• Linux kernel (drivers/iommu/intel): SVA bind and unbind are asymmetric on VT-d hardware without PCI/PRI - bind skipsCVE-2026-64591 · Linux kernel (drivers/iommu/intel)Medium