CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fix page fragment cache leak in error path

In nvmet_tcp_alloc_queue(), when a connection is closed during the
allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN),
the error handling jumps to out_destroy_sq and then to out_ida_remove
without draining the page fragment cache.

Although nvmet_tcp_free_cmd() is called in some error paths to release
individual page fragments, the underlying page cache reference held by
queue->pf_cache is never released. The first allocation using pf_cache
is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens
after ida_alloc() returns successfully. This results in a page leak each
time a connection fails during allocation, which could lead to memory
exhaustion over time if connections are repeatedly opened and closed.

Fix this by calling page_frag_cache_drain() before freeing the queue
structure in the out_ida_remove label.

The Linux kernel CVE team has assigned CVE-2026-74386 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 6.12.97 with commit a43a9abc1ebf663f0aa56a729106f68dd9c77da6
	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 6.18.40 with commit ba3209704b3cd46961e4e081af5c52a780785648
	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 7.1.5 with commit 5fbe83a374f09561a0f0c1f4aa021501ffd681eb
	Issue introduced in 5.0 with commit 872d26a391da92ed8f0c0f5cb5fef428067b7f30 and fixed in 7.2-rc1 with commit 4dae393956093c807212918fd91a8fc70df15338

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74386
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/nvme/target/tcp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a43a9abc1ebf663f0aa56a729106f68dd9c77da6
	https://git.kernel.org/stable/c/ba3209704b3cd46961e4e081af5c52a780785648
	https://git.kernel.org/stable/c/5fbe83a374f09561a0f0c1f4aa021501ffd681eb
	https://git.kernel.org/stable/c/4dae393956093c807212918fd91a8fc70df15338