CVE-2026-64321: Linux Kernel Privilege Escalation Flaw

CVE-2026-64321 Overview

CVE-2026-64321 is a memory leak vulnerability in the Linux kernel's NVMe over Fabrics (NVMe-oF) RDMA target driver. The flaw resides in the nvmet_rdma_queue_connect() function, which calls nvmet_rdma_find_get_device() to acquire a reference on the returned ndev device via kref_get(). When the host queue backlog is exceeded and the function returns NVME_SC_CONNECT_CTRL_BUSY, the code path returns early without releasing the acquired reference, leaking the kref.

The issue affects Linux kernel deployments running NVMe-oF target services over RDMA transports, commonly used in high-performance storage fabrics.

Critical Impact
Repeated triggering of the busy condition on NVMe-oF RDMA target connections leaks device references, preventing resource cleanup and enabling resource exhaustion over time.

Affected Products

Linux kernel with CONFIG_NVME_TARGET_RDMA enabled
Systems providing NVMe-oF target services over RDMA transports (RoCE, InfiniBand, iWARP)
Distributions shipping upstream kernel versions prior to the fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64321 published to the National Vulnerability Database
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64321

Vulnerability Analysis

The vulnerability is a reference count leak [CWE-401] in the Linux kernel NVMe target RDMA transport. When an RDMA client initiates a queue connection, nvmet_rdma_queue_connect() retrieves an internal device context by calling nvmet_rdma_find_get_device(). That helper increments the reference count on the returned ndev structure through kref_get(), obligating the caller to release the reference on all exit paths.

The defective code path handles the case where the host queue backlog is exceeded. Instead of jumping to the put_device cleanup label, the function returns NVME_SC_CONNECT_CTRL_BUSY directly. The ndev reference remains held indefinitely, and the associated device object cannot be freed even after the transport tears down.

An attacker or misbehaving client that repeatedly triggers the busy condition causes progressive kernel memory pressure. Over sustained operation, this can exhaust device slots and degrade the availability of the NVMe-oF target subsystem.

Root Cause

The root cause is a missing goto put_device statement before the early return on the queue backlog exceeded branch. The reference acquired via kref_get() was not paired with the corresponding kref_put() on the error path. The upstream fix adds the missing jump to the existing cleanup label so all exit paths correctly release the device reference.

Attack Vector

The attack vector requires network access to an NVMe-oF RDMA target endpoint. A remote client capable of establishing RDMA queue connections can trigger the busy condition by exceeding the host queue backlog, either through legitimate load or by intentionally crafting connection requests that exceed the configured backlog threshold. Each occurrence leaks one ndev reference, and repeated attempts accumulate leaked references without bound.

Exploitation does not yield code execution or data disclosure. The impact is limited to resource exhaustion and denial of service against the storage target subsystem. See the upstream patches for the exact code change: Kernel Git Commit 5828517 and Kernel Git Commit a8803c4.

Detection Methods for CVE-2026-64321

Indicators of Compromise

Growing count of allocated nvmet_rdma_device structures in kernel slab allocations without corresponding frees
Repeated log entries or trace events showing NVME_SC_CONNECT_CTRL_BUSY (status code 0x8a) returned to RDMA hosts
Unexpected inability to unload the nvmet_rdma module due to non-zero reference counts on device objects

Detection Strategies

Monitor /proc/slabinfo and kernel memory counters for unbounded growth in NVMe target RDMA object caches
Inspect the RDMA subsystem via rdma resource show and NVMe target configfs entries for stale device references
Correlate spikes in RDMA connection attempts against configured queue backlog thresholds to identify abuse patterns

Monitoring Recommendations

Enable kernel ftrace on nvmet_rdma_queue_connect and nvmet_rdma_find_get_device to observe reference acquisition and release balance
Track NVMe-oF connection error rates and alert on sustained CONNECT_CTRL_BUSY responses that indicate backlog saturation
Baseline normal RDMA client connection behavior and flag anomalous connection storms from unexpected initiators

How to Mitigate CVE-2026-64321

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD advisory to all systems running NVMe-oF RDMA target services
Inventory Linux hosts with nvmet_rdma loaded and prioritize storage fabric targets for patching
Restrict RDMA network reachability to trusted NVMe-oF initiators using subnet-level access controls and RDMA connection manager filters

Patch Information

The fix has been merged upstream through the following stable kernel commits, which add the missing goto put_device before the early return on the queue backlog exceeded path:

Consult your Linux distribution's security tracker for backported kernel packages that include these commits.

Workarounds

Unload the nvmet_rdma module on hosts that do not require NVMe-oF RDMA target functionality until a patched kernel is deployed
Increase the host queue backlog configuration to reduce the frequency of the busy condition, acknowledging this only slows leak accumulation rather than eliminating it
Schedule periodic maintenance reboots on unpatched targets to reclaim leaked references and restore baseline kernel memory usage

bash

# Check whether the vulnerable module is loaded
lsmod | grep nvmet_rdma

# Temporarily disable the NVMe-oF RDMA target where not required
sudo modprobe -r nvmet_rdma

# Verify installed kernel version after patching
uname -r