DEBIAN-CVE-2026-64535

In the Linux kernel, the following vulnerability has been resolved:  nvmet-tcp: Fix potential UAF when ddgst mismatch  Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data transfer, the digest error handler in nvmettcptryrecvddgst() calls nvmetrequninit() — which performs percpurefput() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytesdone, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmettcpuninitdataincmds() iterates all commands, checks nvmettcpneeddatain() for each one, and finds that the already-uninited command still appears to need data (because rbytesdone < transferlen and cqe->status == 0). It therefore calls nvmetrequninit() a second time on the same command — a double percpurefput against a single percpuref_get.