CVE-2026-74386

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fix page fragment cache leak in error path

In nvmettcpallocqueue(), when a connection is closed during the allocation process (e.g., nvmettcpsetqueuesock() returns -ENOTCONN), the error handling jumps to outdestroysq and then to outida_remove without draining the page fragment cache.

Although nvmettcpfreecmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pfcache is never released. The first allocation using pfcache is the call to nvmettcpalloccmd() for queue->connect, which happens after ida_alloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed.

Fix this by calling pagefragcachedrain() before freeing the queue structure in the outida_remove label.