External risk intelligence

Linux Kernel nvmet-tcp Refcount Underflow Leads to Workqueue Deadlock.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64534

The vulnerability exists in the Linux kernel's NVMe-over-TCP target driver. While this component facilitates network-based storage communication, it is typically deployed within controlled, private data center fabric or storage area networks. It is not intended for direct exposure to the public internet, and its deployment is generally restricted to isolated infrastructure environments.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a flaw in the Linux kernel's network storage component, which, if exploited, could lead to system instability and potential denial of service due to a workqueue deadlock. The main concern is confirming relevance and exposure.

Flaw in network storage could cause system deadlock.
Matters for systems using specific Linux network storage.
Confirm if your environment is affected by this issue.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic to a system running a vulnerable version of the Linux kernel's NVMe-over-TCP target driver. If a data digest mismatch occurs during processing, the system could enter an error path that, under certain conditions, leads to a use-after-free vulnerability. This could result in a system-wide workqueue deadlock, rendering the system unusable.

Network access required.
Triggered by data digest mismatch.
Leads to workqueue deadlock.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability in the Linux kernel's NVMe-over-TCP driver could lead to a workqueue deadlock, potentially impacting the stability and availability of storage services.

System stability and storage services.
Unconditional call during error path.
Permanent workqueue deadlock.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's NVMe-over-TCP driver is likely managed by infrastructure or platform teams. The first action should be to identify all instances of this kernel component, confirm its reachability and business criticality, and then engage the appropriate system owner to plan remediation during the next maintenance window.

Infrastructure or platform teams own resolution.
Verify NVMe-over-TCP component presence and reachability.
Plan remediation based on identified exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel nvmet-tcp component?

It is a specialized Linux kernel driver that enables NVMe-over-TCP, a technology used to transport high-speed NVMe storage commands over standard TCP/IP networks. It essentially allows servers to access remote storage devices as if they were locally attached, typically within high-performance data center storage fabrics.

How does this flaw create a system deadlock?

This vulnerability involves a resource management error. Specifically, it causes a reference count underflow when the system attempts to handle a data digest mismatch incorrectly. By prematurely releasing internal resources that were not properly initialized, the system enters an unstable state that results in a permanent workqueue deadlock, effectively freezing the affected storage service.

Do I need a network-triggered digest error to hit this?

Yes, the issue is triggered when a data digest mismatch is detected during network communication. This requires the system to receive specific, malformed, or mismatching network traffic. It does not trigger during successful, valid storage operations; the error path only activates when the driver encounters an invalid data integrity check.

Is my infrastructure at risk according to Halo Surface Signal?

Halo Surface Signal notes that this vulnerability is unlikely to be reachable for most, as the nvmet-tcp driver is typically confined to private, isolated storage area networks. Because this component is not meant for public internet exposure, your risk depends on whether your storage fabric is strictly segmented from external network traffic.

What is the first step for teams using this kernel feature?

Start by identifying all servers or storage controllers in your environment that have the NVMe-over-TCP target driver enabled. Once identified, verify their network isolation to ensure they are not reachable from untrusted networks. Engage your infrastructure or platform teams to prioritize patching this kernel component during your next scheduled maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.