SB20260727257 - Missing Release of Resource after Effective Lifetime in Linux kernel nvme target driver

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64321)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a reference count leak in nvmet_rdma_queue_connect() in the nvme target rdma component when handling queue connect requests while the host queue backlog is exceeded. A remote attacker can send connection requests that trigger the busy return path to cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5828517d17eda27f21d29ea14800c9e0a57bad11
• https://git.kernel.org/stable/c/a8803c4f0ac3fa7df5551bbb5a8800c434a94357
• https://git.kernel.org/stable/c/badc53620fe813b3a9f727ef9526f98567c2c898
• https://git.kernel.org/stable/c/d65fe42820b890a6a4644de0a95a812471f79ad3