SB2026081572 - Improper resource shutdown or release in Linux kernel nvme target driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-74386)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in nvmet_tcp_alloc_queue() in the NVMe target TCP component when handling connection closure during queue allocation. A remote attacker can repeatedly open and close connections to cause a denial of service.

The issue occurs on an error path where the page fragment cache reference held by queue->pf_cache is not released, leading to a page leak over time.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4dae393956093c807212918fd91a8fc70df15338
• https://git.kernel.org/stable/c/5fbe83a374f09561a0f0c1f4aa021501ffd681eb
• https://git.kernel.org/stable/c/a43a9abc1ebf663f0aa56a729106f68dd9c77da6
• https://git.kernel.org/stable/c/ba3209704b3cd46961e4e081af5c52a780785648