Database/Kernel, userspace & hypervisor
Linux kernel (drivers/nvme/target): A client connected to your NVMe-oF TCP target can drive a reference-count underflow
Impact
A client connected to your NVMe-oF TCP target can drive a reference-count underflow on a target-side request object, giving a use-after-free on the shared storage node and, past that, a permanently wedged workqueue. Once the workqueue is stuck the target stops serving every subsystem it exports, so one tenant's malformed traffic becomes a storage outage for everyone homed on that node.
Who can reach it
Reachable by any peer on the IP/storage fabric that can open a TCP connection to the nvmet-tcp listener - the trigger is a command that fails nvmet_req_init (an unsupported opcode is enough) followed by a deliberately wrong data digest, both fully under the sender's control and both landing before any meaningful authorization on the command. Requires the node to be running nvmet with a tcp port enabled and data digest negotiated; no tenant device node is needed, only network reach to the target port.
What to do
No fixed version is listed on this record beyond the 5.10.261 / 5.12 stable branches - boot a kernel carrying the linked stable commits. Interim: restrict the nvmet-tcp listener to a management/storage VLAN that tenant workloads cannot address, or stop exporting the nvmet subsystem until the node is patched.
References
Related entries
- Linux kernel (drivers/nvme/target): When the target's peer-to-peer memory pool runs dry, it still tries to return theCVE-2021-47130 · Linux kernel (drivers/nvme/target)High
- Linux kernel (drivers/nvme/target): A connecting client that abandons the TCP connection at the right moment duringCVE-2025-38035 · Linux kernel (drivers/nvme/target)High
- Linux kernel (drivers/nvme/target): Every command a client sends to the target carrying metadata (protectionCVE-2025-38405 · Linux kernel (drivers/nvme/target)High
- Linux kernel (drivers/nvme/target): Ordinary client I/O to an nvmet block-device namespace can hit a completion raceCVE-2026-23148 · Linux kernel (drivers/nvme/target)High
- Linux kernel (drivers/nvme/target): A client that completes the TLS handshake against the NVMe-oF TCP target and thenCVE-2026-74385 · Linux kernel (drivers/nvme/target)High
- Linux kernel (drivers/nvme/target): Every connection that dies partway through queue allocation on the NVMe-oF TCPCVE-2026-74386 · Linux kernel (drivers/nvme/target)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.