CVE-2026-64535: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-5wfv-mpg7-6vcr
Share
CVSS 9.8
CWE-415
Published
Advisory Summary

CVE-2026-64535 is a CRITICAL (CVSS 9.8) security vulnerability vulnerability (CWE-415: Double Free) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product calls free() twice on the same memory address.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64535 at a Glance

CVE Identifier CVE-2026-64535
GHSA Identifier GHSA-5wfv-mpg7-6vcr
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-415: Double Free
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-64535

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64535, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-415: Double Free, where the product calls free() twice on the same memory address. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get.

References

NVD — CVE-2026-64535 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64535
git.kernel.org/stable/c/088ee46c18... WEB
https://git.kernel.org/stable/c/088ee46c18d99baef453afd74181dd40ade044ad
git.kernel.org/stable/c/6f9442983a... WEB
https://git.kernel.org/stable/c/6f9442983a3e4227afd1c83a5251ddbca585ea21
git.kernel.org/stable/c/7e558308eb... WEB
https://git.kernel.org/stable/c/7e558308eba14c8136cb1e615f0c850f76d1fc0a
git.kernel.org/stable/c/96fe2513df... WEB
https://git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e
git.kernel.org/stable/c/dbbd07d0a7... WEB
https://git.kernel.org/stable/c/dbbd07d0a7020b80f6a7028e561908f7b83b3d5a
git.kernel.org/stable/c/dfb902462b... WEB
https://git.kernel.org/stable/c/dfb902462bca478f050224ec7a7195aafa7643b1
git.kernel.org/stable/c/e091ff83d9... WEB
https://git.kernel.org/stable/c/e091ff83d962f9ed00d9bd70443676de9fe98bdc

Frequently Asked Questions

What is CVE-2026-64535?
CVE-2026-64535 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-415: Double Free.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-64535?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-64535?
CVE-2026-64535 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-64535?
CVE-2026-64535 is classified under CWE-415: Double Free (The product calls free() twice on the same memory address.).
How can I check Maven dependencies for CVE-2026-64535?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5wfv-mpg7-6vcr",
  "modified" : "2026-10-19T21:35:39Z",
  "published" : "2026-07-27T09:31:27Z",
  "aliases" : [ "CVE-2026-64535" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: Fix potential UAF when ddgst mismatch\n\nShivam Kumar found via vulnerability testing:\nWhen data digest is enabled on an NVMe/TCP connection and a digest\nmismatch occurs on a non-final H2C_DATA PDU during an R2T-based\ndata transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()\ncalls nvmet_req_uninit() — which performs percpu_ref_put() on the\nsubmission queue — but does NOT mark the command as completed. It\ndoes not set cqe->status, does not modify rbytes_done, and does not\nclear any flag. When the subsequent fatal error triggers queue\nteardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,\nchecks nvmet_tcp_need_data_in() for each one, and finds that the\nalready-uninited command still appears to need data (because\nrbytes_done < transfer_len and cqe->status == 0). It therefore calls\nnvmet_req_uninit() a second time on the same command — a double\npercpu_ref_put against a single percpu_ref_get.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64535"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/088ee46c18d99baef453afd74181dd40ade044ad"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6f9442983a3e4227afd1c83a5251ddbca585ea21"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7e558308eba14c8136cb1e615f0c850f76d1fc0a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dbbd07d0a7020b80f6a7028e561908f7b83b3d5a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dfb902462bca478f050224ec7a7195aafa7643b1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e091ff83d962f9ed00d9bd70443676de9fe98bdc"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-415" ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-27T08:16:22Z"
  }
}