External risk intelligence

Linux Kernel nvmet-tcp Double Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64535

The vulnerability exists in the Linux kernel's NVMe/TCP transport implementation. While NVMe/TCP operates over the network, it is primarily used for storage area networking in data centers between hosts and storage targets. It is not typically exposed directly to the public internet, usually residing within isolated or private storage infrastructure.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE addresses a critical vulnerability within the Linux kernel's NVMe/TCP component. The issue involves a potential use-after-free error that could be triggered during data transfers when specific error conditions related to data digests are met. At a high level, this could lead to system instability or compromise if exploited, though the specific technology and its typical deployment context are important considerations for assessing impact.

A kernel flaw may allow code execution during network storage operations.
Crucial for systems using network-attached storage over TCP.
Confirm relevance and assess potential exposure within our environment.

Attack Path

How an attacker could exploit the issue

An attacker could potentially exploit this vulnerability by initiating a data transfer over an NVMe/TCP connection where data integrity checks are enabled. If a specific type of data packet encounters a mismatch in its integrity check during a particular phase of the data transfer, the system may mishandle the error, leading to a crash or unintended behavior. This could allow an attacker to disrupt service or potentially gain further access.

Network exposure required.
Data digest mismatch triggers vulnerability.
Potential for denial of service.

Live Threat

Current exploitation, exposure, and threat context

When data digest mismatches occur during NVMe/TCP data transfers, the kernel could attempt to free resources twice. This condition may impact system stability.

NVMe/TCP transport data.
Digest mismatch during data transfer.
Potential system instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's NVMe/TCP implementation, suggesting that infrastructure or platform teams managing storage networks are the most likely owners. The immediate first step is to identify all systems utilizing NVMe/TCP, determine their business criticality and network exposure, and then locate the specific accountable owner for remediation planning.

Infrastructure/Platform teams own resolution.
Verify NVMe/TCP usage and reachability.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel nvmet-tcp component?

It is a part of the Linux kernel that enables NVMe over Fabrics (NVMe-oF) using the TCP transport protocol. This technology allows servers to access high-speed storage devices across a standard network, effectively letting a computer treat a remote network drive as if it were directly connected to the system. It is widely used in data centers to build scalable and high-performance storage area networks.

How does CVE-2026-64535 cause a vulnerability?

This vulnerability is a Use-After-Free flaw. It occurs when the kernel incorrectly manages memory resources after an error happens during a data transfer. Specifically, the system attempts to release memory that has already been cleared. This type of memory management error can lead to system instability, crashes, or unpredictable behavior when the kernel tries to interact with those freed memory locations.

Do I need data digests enabled to trigger this bug?

Yes, the vulnerability is specifically linked to the data digest feature. It is triggered when a digest mismatch occurs on a non-final data packet during a specific type of storage transfer. If data digests are disabled for your NVMe/TCP connections, the specific code path containing this error handling flaw is not executed, meaning this particular trigger condition would not apply.

Is my system at risk from CVE-2026-64535?

According to Halo Surface Signal, this vulnerability is unlikely to affect most systems because NVMe/TCP is typically used in private or isolated data center storage networks, not directly on the public internet. You should primarily be concerned if your infrastructure uses NVMe/TCP to expose storage across untrusted network segments or if your internal storage management systems are accessible to unauthorized users.

How should I respond to this Linux kernel vulnerability?

Start by auditing your environment to locate all systems running NVMe/TCP. Coordinate with your infrastructure or platform teams to assess the network reachability of these storage interfaces. Once identified, prioritize these systems for kernel updates provided by your Linux distribution vendor, as this is a core kernel component that requires a system patch to resolve the memory management logic error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.