{"apiVersion":"1.0","identifier":"CVE-2026-74386","description":"In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmet_tcp_alloc_queue(), when a connection is closed during the allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), the error handling jumps to out_destroy_sq and then to out_ida_remove without draining the page fragment cache. Although nvmet_tcp_free_cmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pf_cache is never released. The first allocation using pf_cache is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens after ida_alloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed. Fix this by calling page_frag_cache_drain() before freeing the queue structure in the out_ida_remove label.","publishedAt":"2026-08-15T06:22:40","lastModifiedAt":"2026-08-17T06:19:33","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74386","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00168,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74386","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74386","en":"https://www.redsauce.net/en/cves/CVE-2026-74386","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74386","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74386","de":"https://www.redsauce.net/de/cves/CVE-2026-74386","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74386","el":"https://www.redsauce.net/el/cves/CVE-2026-74386"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74386"}}