Linux kernel (drivers/nvme/target): A client that completes the TLS handshake against the NVMe-oF TCP target and then

CVSS 7.5CVE-2026-74385Kernel, userspace & hypervisorcurated

Impact

A client that completes the TLS handshake against the NVMe-oF TCP target and then lets the socket fall out of the established state leaks the whole queue structure and its socket - the target never notices the failure and never cleans up. Repeating it exhausts memory and socket resources on the shared storage node.

Who can reach it

Reachable from any peer on the fabric that can complete a TLS handshake with the nvmet-tcp listener; the leak is in the handshake-completion callback, so it lands before the controller association is established. Conditional on nvmet-tcp being configured with TLS - a plain-text target is not affected by this path.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: restrict fabric reachability of the TLS-enabled nvmet-tcp port to the storage network, and watch for queue/socket counts that climb without a matching client population.

References

https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462 https://nvd.nist.gov/vuln/detail/CVE-2026-74385

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.