CVE-2026-64534

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: check INITFAILED before nvmetreq_uninit in digest error path

In nvmettcptryrecvddgst(), when a data digest mismatch is detected,

nvmetrequninit() is called unconditionally. However, if the command

arrived via the nvmettcphandlereqfailure() path, nvmetreqinit()

had returned false and percpureftryget_live() was never executed. The

unconditional percpurefput() inside nvmetrequninit() then causes a

refcount underflow, leading to a WARNING in

percpurefswitchtoatomic_rcu, a use-after-free diagnostic, and

eventually a permanent workqueue deadlock.

Check cmd->flags & NVMETTCPFINITFAILED before calling

nvmetrequninit(), matching the existing pattern in

nvmettcpexecute_request().