CVE-2026-64535

Critical

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get.

Package Linux Kernel
Published 2026-07-27
Last modified 2026-08-19
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

9.8

out of 10
Critical
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 5.10.20, 5.11.3, 5.12 and later are affected. Fixed in 5.10.265, 5.15.216, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1 and their respective stable series.

Affected from
≥ 5.10.20 ≥ 5.11.3 ≥ 5.12
Fixed in
✓ 5.10.265 5.10.x ✓ 5.15.216 5.15.x ✓ 6.1.178 6.1.x ✓ 6.6.145 6.6.x ✓ 6.12.97 6.12.x ✓ 6.18.40 6.18.x ✓ 7.1

References

7 total
Showing 5 of 7 references View all on NVD

Frequently asked questions

  • What is CVE-2026-64535?

    CVE-2026-64535 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.8 out of 10 . It affects Linux kernel versions from 5.10.20 onward and has been patched in 5.10.265, 5.15.216, 6.1.178 and others. CVE-2026-64535 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2026-64535?

    CVE-2026-64535 has a CVSS score of 9.8 out of 10, rated Critical severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H .

  • Is there a patch available for CVE-2026-64535?

    Yes. CVE-2026-64535 has been patched. Fixed versions include 5.10.265, 5.15.216, 6.1.178 and others. If you are running Linux kernel 5.10.20 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-64535 actively exploited?

    No. CVE-2026-64535 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST