Medium severity5.5NVD Advisory· Published Jul 25, 2026· Updated Sep 4, 2026
CVE-2026-64321
CVE-2026-64321
Description
In the Linux kernel, the following vulnerability has been resolved:
nvme: target: rdma: fix ndev refcount leak on queue connect
nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() which acquires a reference on the returned ndev via kref_get(). On the path where the host queue backlog is exceeded and the function returns NVME_SC_CONNECT_CTRL_BUSY, reference of ndev is not released, leaking the kref.
Fix this by adding a goto to the existing put_device label before the early return.
Affected products
3- osv-coords2 versions
>= 6.8.0, < 6.12.96+ 1 more
- (no CPE)range: >= 6.8.0, < 6.12.96
- (no CPE)range: < 7.1.7-1.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.