nvme: target: rdma: fix ndev refcount leak on queue connect

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-64321
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-25 10:17:13 UTC
Updated2026-07-25 10:17:13 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: nvme: target: rdma: fix ndev refcount leak on queue connect nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() which acquires a reference on the returned ndev via kref_get(). On the path where the host queue backlog is exceeded and the function returns NVME_SC_CONNECT_CTRL_BUSY, reference of ndev is not released, leaking the kref. Fix this by adding a goto to the existing put_device label before the early return.

Risk And Classification

EPSS: 0.001680000 probability, percentile 0.064150000 (date 2026-07-26)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 31deaeb11ba7a885116c9c30892b9f763c04d59c d65fe42820b890a6a4644de0a95a812471f79ad3 git Not specified
CNA Linux Linux affected 31deaeb11ba7a885116c9c30892b9f763c04d59c a8803c4f0ac3fa7df5551bbb5a8800c434a94357 git Not specified
CNA Linux Linux affected 31deaeb11ba7a885116c9c30892b9f763c04d59c 5828517d17eda27f21d29ea14800c9e0a57bad11 git Not specified
CNA Linux Linux affected 31deaeb11ba7a885116c9c30892b9f763c04d59c badc53620fe813b3a9f727ef9526f98567c2c898 git Not specified
CNA Linux Linux affected 6.8 Not specified
CNA Linux Linux unaffected 6.8 semver Not specified
CNA Linux Linux unaffected 6.12.96 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.39 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.4 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/badc53620fe813b3a9f727ef9526f98567c2c898 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5828517d17eda27f21d29ea14800c9e0a57bad11 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a8803c4f0ac3fa7df5551bbb5a8800c434a94357 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d65fe42820b890a6a4644de0a95a812471f79ad3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report