FKIE_CVE-2026-64071
Vulnerability from fkie_nvd - Published: 2026-07-19 16:17 - Updated: 2026-09-03 14:54
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix use-after-free in nvme_free_host_mem()
nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous()
but never clears the pointer afterward. This leads to a use-after-free
if nvme_free_host_mem() is called twice in the same error path.
This can happen during nvme_probe() when nvme_setup_host_mem() succeeds
in allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem()
fails with an I/O error:
nvme_setup_host_mem()
nvme_alloc_host_mem_single() -> sets dev->hmb_sgt
nvme_set_host_mem() -> fails with -EIO
nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it
return error
nvme_probe() error path:
nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free
The second call dereferences the freed sgt, causing a NULL pointer
dereference in iommu_dma_free_noncontiguous() when it accesses
sgt->sgl->dma_address (the backing memory has been freed and zeroed).
This is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC
Envoy Express behind a Dell WD22TB4 dock) where the device intermittently
returns I/O errors during HMB setup due to PCIe link instability.
BUG: kernel NULL pointer dereference, address: 0000000000000010
RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80
Call Trace:
<TASK>
dma_free_noncontiguous+0x3b/0x130
nvme_free_host_mem+0x30/0xf0 [nvme]
nvme_probe.cold+0xcc/0x275 [nvme]
local_pci_probe+0x43/0xa0
pci_device_probe+0xeea/0x290
really_probe+0xf9/0x3b0
__driver_probe_device+0x8b/0x170
driver_probe_device+0x24/0xd0
__driver_attach_async_helper+0x6b/0x110
async_run_entry_fn+0x37/0x170
process_one_work+0x1ac/0x3d0
worker_thread+0x1b8/0x360
kthread+0xf7/0x130
ret_from_fork+0x2d8/0x3a0
ret_from_fork_asm+0x1a/0x30
</TASK>
Fix this by setting dev->hmb_sgt to NULL after freeing it, so the
second call takes the multi-descriptor path which safely handles the
already-cleaned-up state.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| linux | linux_kernel | * | |
| linux | linux_kernel | * | |
| linux | linux_kernel | 7.1 | |
| linux | linux_kernel | 7.1 | |
| linux | linux_kernel | 7.1 |
{
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9525e3a6fbb1d126a22ab2ee86ddea25af581a7c",
"status": "affected",
"version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d",
"versionType": "git"
},
{
"lessThan": "7c89f474005d8377525d2991930b7432ee193a52",
"status": "affected",
"version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d",
"versionType": "git"
},
{
"lessThan": "b35a13036755c5803168a7cb93bc66035c3e65b8",
"status": "affected",
"version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix use-after-free in nvme_free_host_mem()\n\nnvme_free_host_mem() frees dev-\u003ehmb_sgt via dma_free_noncontiguous()\nbut never clears the pointer afterward. This leads to a use-after-free\nif nvme_free_host_mem() is called twice in the same error path.\n\nThis can happen during nvme_probe() when nvme_setup_host_mem() succeeds\nin allocating the HMB (setting dev-\u003ehmb_sgt) but nvme_set_host_mem()\nfails with an I/O error:\n\n nvme_setup_host_mem()\n nvme_alloc_host_mem_single() -\u003e sets dev-\u003ehmb_sgt\n nvme_set_host_mem() -\u003e fails with -EIO\n nvme_free_host_mem() -\u003e frees hmb_sgt, but does NOT NULL it\n return error\n\n nvme_probe() error path:\n nvme_free_host_mem() -\u003e dev-\u003ehmb_sgt is stale, use-after-free\n\nThe second call dereferences the freed sgt, causing a NULL pointer\ndereference in iommu_dma_free_noncontiguous() when it accesses\nsgt-\u003esgl-\u003edma_address (the backing memory has been freed and zeroed).\n\nThis is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC\nEnvoy Express behind a Dell WD22TB4 dock) where the device intermittently\nreturns I/O errors during HMB setup due to PCIe link instability.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80\n Call Trace:\n \u003cTASK\u003e\n dma_free_noncontiguous+0x3b/0x130\n nvme_free_host_mem+0x30/0xf0 [nvme]\n nvme_probe.cold+0xcc/0x275 [nvme]\n local_pci_probe+0x43/0xa0\n pci_device_probe+0xeea/0x290\n really_probe+0xf9/0x3b0\n __driver_probe_device+0x8b/0x170\n driver_probe_device+0x24/0xd0\n __driver_attach_async_helper+0x6b/0x110\n async_run_entry_fn+0x37/0x170\n process_one_work+0x1ac/0x3d0\n worker_thread+0x1b8/0x360\n kthread+0xf7/0x130\n ret_from_fork+0x2d8/0x3a0\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nFix this by setting dev-\u003ehmb_sgt to NULL after freeing it, so the\nsecond call takes the multi-descriptor path which safely handles the\nalready-cleaned-up state."
}
],
"id": "CVE-2026-64071",
"lastModified": "2026-09-03T14:54:13.197",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2026-07-19T16:17:47.687",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/7c89f474005d8377525d2991930b7432ee193a52"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/9525e3a6fbb1d126a22ab2ee86ddea25af581a7c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/b35a13036755c5803168a7cb93bc66035c3e65b8"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…