SB2026081571 - Improper Check or Handling of Exceptional Conditions in Linux kernel nvme target driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74385)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper exception handling in nvmet_tcp_tls_handshake_done when completing a TCP/TLS handshake. A remote attacker can trigger a failure in nvmet_tcp_set_queue_sock to cause a denial of service.

The issue can occur if the socket is not in TCP_ESTABLISHED state, leading to queue and socket leakage.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462
• https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0
• https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb