CVE-2026-74385 (GCVE-0-2026-74385)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-10-21 12:45
VLAI
Title
nvmet-tcp: check return value of nvmet_tcp_set_queue_sock
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock The return value of nvmet_tcp_set_queue_sock() is currently ignored in nvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket not being in TCP_ESTABLISHED state), the socket callbacks will not be properly set, leading to queue and socket leakage. Fix this by capturing the return value and calling nvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:55 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6641 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < 41b63ff99e3ef37d08f3693413dae5ede5e79fe1 (git)
Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < cba2ee57fd302727aea7d41e9d9cd0969f5df0fb (git)
Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < 22aa70f9a0544643ec37d442b6fcb1833d804462 (git)
Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < 7ef789703e2b91775dcb36b2efa46325be31a2a0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.114 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74385",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:55:01.310630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:55:36.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "41b63ff99e3ef37d08f3693413dae5ede5e79fe1",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            },
            {
              "lessThan": "cba2ee57fd302727aea7d41e9d9cd0969f5df0fb",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            },
            {
              "lessThan": "22aa70f9a0544643ec37d442b6fcb1833d804462",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            },
            {
              "lessThan": "7ef789703e2b91775dcb36b2efa46325be31a2a0",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\n\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\nnvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket\nnot being in TCP_ESTABLISHED state), the socket callbacks will not be\nproperly set, leading to queue and socket leakage.\n\nFix this by capturing the return value and calling\nnvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nvmet-tcp, an in-kernel NVMe-over-TCP target that accepts remote TCP connections; the bug triggers in nvmet_tcp_tls_handshake_done() after tls_server_hello_psk() completes, reachable from any network peer that can connect to an exposed NVMe-oF TLS port (typical cloud/storage-server deployment).\nAC:L - An attacker controls both sides of the race by completing the TLS handshake and then closing or resetting the TCP connection so the socket is no longer TCP_ESTABLISHED when nvmet_tcp_set_queue_sock() runs; this is reliably repeatable across new connections without conditions outside attacker control.\nPR:N - Exploitation requires only network reachability to the NVMe-oF TCP target port; no Linux credentials, capabilities, or init-namespace root are needed, and the vulnerable path runs after TCP accept but before NVMe Connect, host NQN allow-list, or DH-HMAC-CHAP in-band authentication.\nUI:N - No victim user action is required; the attacker programmatically opens TLS connections to the NVMe target and times disconnects to hit the failure path, with no need for local users to mount filesystems or perform other interactive steps.\nS:U - Impact is confined to kernel resource exhaustion within the host running the NVMe target; leaked queues and sockets do not cross VM, container, or IOMMU security boundaries and do not constitute privilege escalation beyond the target kernel itself.\nC:N - The defect is a missed cleanup that leaks queue structures, sockets, and TLS key references; there is no use-after-free, out-of-bounds access, or other memory corruption that could expose kernel data to the attacker.\nI:N - No memory corruption, arbitrary write, or code-execution primitive is introduced; the bug only leaves queue and socket objects allocated without installing socket callbacks or scheduling proper teardown.\nA:H - Each successful trigger permanently leaks an nvmet_tcp_queue, socket/file reference, and IDA slot with no automatic recovery; repeated unauthenticated connections can exhaust kernel memory and socket resources, denying NVMe-oF service on internet-facing storage nodes until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:45:33.852Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/41b63ff99e3ef37d08f3693413dae5ede5e79fe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0"
        }
      ],
      "title": "nvmet-tcp: check return value of nvmet_tcp_set_queue_sock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74385",
    "datePublished": "2026-08-15T05:59:01.113Z",
    "dateReserved": "2026-08-15T05:44:03.890Z",
    "dateUpdated": "2026-10-21T12:45:33.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74385",
      "date": "2026-11-11",
      "epss": "0.00441",
      "percentile": "0.38729"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/tcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "41b63ff99e3ef37d08f3693413dae5ede5e79fe1",
                    "status": "affected",
                    "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cba2ee57fd302727aea7d41e9d9cd0969f5df0fb",
                    "status": "affected",
                    "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "22aa70f9a0544643ec37d442b6fcb1833d804462",
                    "status": "affected",
                    "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7ef789703e2b91775dcb36b2efa46325be31a2a0",
                    "status": "affected",
                    "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/tcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.114",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\n\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\nnvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket\nnot being in TCP_ESTABLISHED state), the socket callbacks will not be\nproperly set, leading to queue and socket leakage.\n\nFix this by capturing the return value and calling\nnvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup."
          }
        ],
        "id": "CVE-2026-74385",
        "lastModified": "2026-10-21T13:19:43.570",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-74385",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:55:01.310630Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-15T06:22:40.420",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/41b63ff99e3ef37d08f3693413dae5ede5e79fe1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-06T00:38:27+00:00",
      "cve": "CVE-2026-74385",
      "id": "CVE-2026-74385",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "92",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74385.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-11-11T02:11:24Z",
      "cve": "CVE-2026-74385",
      "id": "CVE-2026-74385",
      "initial_release_date": "2026-09-03T00:06:29Z",
      "product_status:known_affected": "486",
      "product_status:known_not_affected": "239",
      "product_status:recommended": "252",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74385",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-74385.json",
      "version": "14"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-74385",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-16T18:55:01.310630Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-16T18:55:03.729Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/nvme/target/tcp.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "41b63ff99e3ef37d08f3693413dae5ede5e79fe1",
                  "status": "affected",
                  "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
                  "versionType": "git"
                },
                {
                  "lessThan": "cba2ee57fd302727aea7d41e9d9cd0969f5df0fb",
                  "status": "affected",
                  "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
                  "versionType": "git"
                },
                {
                  "lessThan": "22aa70f9a0544643ec37d442b6fcb1833d804462",
                  "status": "affected",
                  "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
                  "versionType": "git"
                },
                {
                  "lessThan": "7ef789703e2b91775dcb36b2efa46325be31a2a0",
                  "status": "affected",
                  "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/nvme/target/tcp.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.7"
                },
                {
                  "lessThan": "6.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.114",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.18.*",
                  "status": "unaffected",
                  "version": "6.18.40",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.1.*",
                  "status": "unaffected",
                  "version": "7.1.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "7.2",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.114",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18.40",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.1.5",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.2",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\n\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\nnvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket\nnot being in TCP_ESTABLISHED state), the socket callbacks will not be\nproperly set, leading to queue and socket leakage.\n\nFix this by capturing the return value and calling\nnvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The flaw is in nvmet-tcp, an in-kernel NVMe-over-TCP target that accepts remote TCP connections; the bug triggers in nvmet_tcp_tls_handshake_done() after tls_server_hello_psk() completes, reachable from any network peer that can connect to an exposed NVMe-oF TLS port (typical cloud/storage-server deployment).\nAC:L - An attacker controls both sides of the race by completing the TLS handshake and then closing or resetting the TCP connection so the socket is no longer TCP_ESTABLISHED when nvmet_tcp_set_queue_sock() runs; this is reliably repeatable across new connections without conditions outside attacker control.\nPR:N - Exploitation requires only network reachability to the NVMe-oF TCP target port; no Linux credentials, capabilities, or init-namespace root are needed, and the vulnerable path runs after TCP accept but before NVMe Connect, host NQN allow-list, or DH-HMAC-CHAP in-band authentication.\nUI:N - No victim user action is required; the attacker programmatically opens TLS connections to the NVMe target and times disconnects to hit the failure path, with no need for local users to mount filesystems or perform other interactive steps.\nS:U - Impact is confined to kernel resource exhaustion within the host running the NVMe target; leaked queues and sockets do not cross VM, container, or IOMMU security boundaries and do not constitute privilege escalation beyond the target kernel itself.\nC:N - The defect is a missed cleanup that leaks queue structures, sockets, and TLS key references; there is no use-after-free, out-of-bounds access, or other memory corruption that could expose kernel data to the attacker.\nI:N - No memory corruption, arbitrary write, or code-execution primitive is introduced; the bug only leaves queue and socket objects allocated without installing socket callbacks or scheduling proper teardown.\nA:H - Each successful trigger permanently leaks an nvmet_tcp_queue, socket/file reference, and IDA slot with no automatic recovery; repeated unauthenticated connections can exhaust kernel memory and socket resources, denying NVMe-oF service on internet-facing storage nodes until reboot."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-21T12:45:33.852Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/41b63ff99e3ef37d08f3693413dae5ede5e79fe1"
            },
            {
              "url": "https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb"
            },
            {
              "url": "https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462"
            },
            {
              "url": "https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0"
            }
          ],
          "title": "nvmet-tcp: check return value of nvmet_tcp_set_queue_sock",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2026-74385",
        "datePublished": "2026-08-15T05:59:01.113Z",
        "dateReserved": "2026-08-15T05:44:03.890Z",
        "dateUpdated": "2026-10-21T12:45:33.852Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.