Vulnerability-Lookup

GHSA-33R9-VMMW-Q268

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: check return value of nvmet_tcp_set_queue_sock

The return value of nvmet_tcp_set_queue_sock() is currently ignored in nvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket not being in TCP_ESTABLISHED state), the socket callbacks will not be properly set, leading to queue and socket leakage.

Fix this by capturing the return value and calling nvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74385"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:22:40Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\n\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\nnvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket\nnot being in TCP_ESTABLISHED state), the socket callbacks will not be\nproperly set, leading to queue and socket leakage.\n\nFix this by capturing the return value and calling\nnvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup.",
  "id": "GHSA-33r9-vmmw-q268",
  "modified": "2026-08-17T06:33:42Z",
  "published": "2026-08-15T06:32:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74385"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74385 (GCVE-0-2026-74385)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:46

Title

nvmet-tcp: check return value of nvmet_tcp_set_queue_sock

Summary

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock The return value of nvmet_tcp_set_queue_sock() is currently ignored in nvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket not being in TCP_ESTABLISHED state), the socket callbacks will not be properly set, leading to queue and socket leakage. Fix this by capturing the return value and calling nvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/cba2ee57fd302727a…
https://git.kernel.org/stable/c/22aa70f9a0544643e…
https://git.kernel.org/stable/c/7ef789703e2b91775…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < cba2ee57fd302727aea7d41e9d9cd0969f5df0fb (git) Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < 22aa70f9a0544643ec37d442b6fcb1833d804462 (git) Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < 7ef789703e2b91775dcb36b2efa46325be31a2a0 (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cba2ee57fd302727aea7d41e9d9cd0969f5df0fb",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            },
            {
              "lessThan": "22aa70f9a0544643ec37d442b6fcb1833d804462",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            },
            {
              "lessThan": "7ef789703e2b91775dcb36b2efa46325be31a2a0",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\n\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\nnvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket\nnot being in TCP_ESTABLISHED state), the socket callbacks will not be\nproperly set, leading to queue and socket leakage.\n\nFix this by capturing the return value and calling\nnvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nvmet-tcp, an in-kernel NVMe-over-TCP target that accepts remote TCP connections; the bug triggers in nvmet_tcp_tls_handshake_done() after tls_server_hello_psk() completes, reachable from any network peer that can connect to an exposed NVMe-oF TLS port (typical cloud/storage-server deployment).\nAC:L - An attacker controls both sides of the race by completing the TLS handshake and then closing or resetting the TCP connection so the socket is no longer TCP_ESTABLISHED when nvmet_tcp_set_queue_sock() runs; this is reliably repeatable across new connections without conditions outside attacker control.\nPR:N - Exploitation requires only network reachability to the NVMe-oF TCP target port; no Linux credentials, capabilities, or init-namespace root are needed, and the vulnerable path runs after TCP accept but before NVMe Connect, host NQN allow-list, or DH-HMAC-CHAP in-band authentication.\nUI:N - No victim user action is required; the attacker programmatically opens TLS connections to the NVMe target and times disconnects to hit the failure path, with no need for local users to mount filesystems or perform other interactive steps.\nS:U - Impact is confined to kernel resource exhaustion within the host running the NVMe target; leaked queues and sockets do not cross VM, container, or IOMMU security boundaries and do not constitute privilege escalation beyond the target kernel itself.\nC:N - The defect is a missed cleanup that leaks queue structures, sockets, and TLS key references; there is no use-after-free, out-of-bounds access, or other memory corruption that could expose kernel data to the attacker.\nI:N - No memory corruption, arbitrary write, or code-execution primitive is introduced; the bug only leaves queue and socket objects allocated without installing socket callbacks or scheduling proper teardown.\nA:H - Each successful trigger permanently leaks an nvmet_tcp_queue, socket/file reference, and IDA slot with no automatic recovery; repeated unauthenticated connections can exhaust kernel memory and socket resources, denying NVMe-oF service on internet-facing storage nodes until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:35.426Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0"
        }
      ],
      "title": "nvmet-tcp: check return value of nvmet_tcp_set_queue_sock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74385",
    "datePublished": "2026-08-15T05:59:01.113Z",
    "dateReserved": "2026-08-15T05:44:03.890Z",
    "dateUpdated": "2026-08-17T05:46:35.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.