Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-64321

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a reference count leak in nvmet_rdma_queue_connect() in the nvme target rdma component when handling queue connect requests while the host queue backlog is exceeded. A remote attacker can send connection requests that trigger the busy return path to cause a denial of service.

Affected software

How to mitigate CVE-2026-64321

External References

• https://git.kernel.org/stable/c/5828517d17eda27f21d29ea14800c9e0a57bad11
• https://git.kernel.org/stable/c/a8803c4f0ac3fa7df5551bbb5a8800c434a94357
• https://git.kernel.org/stable/c/badc53620fe813b3a9f727ef9526f98567c2c898
• https://git.kernel.org/stable/c/d65fe42820b890a6a4644de0a95a812471f79ad3

Related Security Bulletins

• Missing Release of Resource after Effective Lifetime in Linux kernel nvme target driver