GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74385 (GCVE-0-2026-74385)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:46
VLAI
Title
nvmet-tcp: check return value of nvmet_tcp_set_queue_sock
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock The return value of nvmet_tcp_set_queue_sock() is currently ignored in nvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket not being in TCP_ESTABLISHED state), the socket callbacks will not be properly set, leading to queue and socket leakage. Fix this by capturing the return value and calling nvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < cba2ee57fd302727aea7d41e9d9cd0969f5df0fb (git)
Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < 22aa70f9a0544643ec37d442b6fcb1833d804462 (git)
Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < 7ef789703e2b91775dcb36b2efa46325be31a2a0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cba2ee57fd302727aea7d41e9d9cd0969f5df0fb",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            },
            {
              "lessThan": "22aa70f9a0544643ec37d442b6fcb1833d804462",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            },
            {
              "lessThan": "7ef789703e2b91775dcb36b2efa46325be31a2a0",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\n\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\nnvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket\nnot being in TCP_ESTABLISHED state), the socket callbacks will not be\nproperly set, leading to queue and socket leakage.\n\nFix this by capturing the return value and calling\nnvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nvmet-tcp, an in-kernel NVMe-over-TCP target that accepts remote TCP connections; the bug triggers in nvmet_tcp_tls_handshake_done() after tls_server_hello_psk() completes, reachable from any network peer that can connect to an exposed NVMe-oF TLS port (typical cloud/storage-server deployment).\nAC:L - An attacker controls both sides of the race by completing the TLS handshake and then closing or resetting the TCP connection so the socket is no longer TCP_ESTABLISHED when nvmet_tcp_set_queue_sock() runs; this is reliably repeatable across new connections without conditions outside attacker control.\nPR:N - Exploitation requires only network reachability to the NVMe-oF TCP target port; no Linux credentials, capabilities, or init-namespace root are needed, and the vulnerable path runs after TCP accept but before NVMe Connect, host NQN allow-list, or DH-HMAC-CHAP in-band authentication.\nUI:N - No victim user action is required; the attacker programmatically opens TLS connections to the NVMe target and times disconnects to hit the failure path, with no need for local users to mount filesystems or perform other interactive steps.\nS:U - Impact is confined to kernel resource exhaustion within the host running the NVMe target; leaked queues and sockets do not cross VM, container, or IOMMU security boundaries and do not constitute privilege escalation beyond the target kernel itself.\nC:N - The defect is a missed cleanup that leaks queue structures, sockets, and TLS key references; there is no use-after-free, out-of-bounds access, or other memory corruption that could expose kernel data to the attacker.\nI:N - No memory corruption, arbitrary write, or code-execution primitive is introduced; the bug only leaves queue and socket objects allocated without installing socket callbacks or scheduling proper teardown.\nA:H - Each successful trigger permanently leaks an nvmet_tcp_queue, socket/file reference, and IDA slot with no automatic recovery; repeated unauthenticated connections can exhaust kernel memory and socket resources, denying NVMe-oF service on internet-facing storage nodes until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:35.426Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0"
        }
      ],
      "title": "nvmet-tcp: check return value of nvmet_tcp_set_queue_sock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74385",
    "datePublished": "2026-08-15T05:59:01.113Z",
    "dateReserved": "2026-08-15T05:44:03.890Z",
    "dateUpdated": "2026-08-17T05:46:35.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74385",
      "date": "2026-09-05",
      "epss": "0.00426",
      "percentile": "0.35635"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74385\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:40.420\",\"lastModified\":\"2026-08-17T06:19:33.460\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\\n\\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\\nnvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket\\nnot being in TCP_ESTABLISHED state), the socket callbacks will not be\\nproperly set, leading to queue and socket leakage.\\n\\nFix this by capturing the return value and calling\\nnvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/nvme/target/tcp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"675b453e024154dd547921c6e6d5b58747ba7e0e\",\"lessThan\":\"cba2ee57fd302727aea7d41e9d9cd0969f5df0fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"675b453e024154dd547921c6e6d5b58747ba7e0e\",\"lessThan\":\"22aa70f9a0544643ec37d442b6fcb1833d804462\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"675b453e024154dd547921c6e6d5b58747ba7e0e\",\"lessThan\":\"7ef789703e2b91775dcb36b2efa46325be31a2a0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/nvme/target/tcp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T20:53:43+00:00",
      "cve": "CVE-2026-74385",
      "id": "CVE-2026-74385",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74385.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.