CVE-2026-64020 (GCVE-0-2026-64020)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
Title
nvme-pci: fix dma_vecs leak on p2p memory
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma_vecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b8b7570a7ec872f2a27b775c4f8710ca8a357adf , < 24ea0de233d9ebb5ebd6f6018eaf2084af25e3dd (git)
Affected: b8b7570a7ec872f2a27b775c4f8710ca8a357adf , < 85686c72966c5ee637893f124ddb31a1cace7bee (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24ea0de233d9ebb5ebd6f6018eaf2084af25e3dd",
              "status": "affected",
              "version": "b8b7570a7ec872f2a27b775c4f8710ca8a357adf",
              "versionType": "git"
            },
            {
              "lessThan": "85686c72966c5ee637893f124ddb31a1cace7bee",
              "status": "affected",
              "version": "b8b7570a7ec872f2a27b775c4f8710ca8a357adf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix dma_vecs leak on p2p memory\n\nWe don\u0027t unmap P2P memory, so we don\u0027t need to track it. The dma_vec\nallocation was getting leaked on the completion."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On NVMe-oF storage servers with p2pmem-enabled namespaces backed by local PCIe NVMe, a remote client can trigger this via nvmet-tcp read/write commands that flow through submit_bio() into nvme-pci P2P PRP setup and completion.\nAC:L - Once the P2P-capable NVMe/IOMMU configuration is present, a single crafted read or write reliably leaks the dma_vecs allocation; no races or special memory layout are required.\nPR:N - Remote exploitation via nvmet-tcp requires no local privileges on the target when in-band authentication is not configured, matching pre-authentication network service guidance for fabric targets.\nUI:N - Exploitation is achieved entirely through NVMe I/O commands and requires no victim interaction beyond the attacker (or their client) initiating storage operations.\nS:U - The vulnerability causes kernel memory leakage and NVMe I/O denial within the same kernel security boundary; it does not cross VM, container, or IOMMU isolation boundaries.\nC:N - This is a kmalloc/mempool leak with no out-of-bounds read, use-after-free, or information disclosure; freed dma_vecs tracking memory is not exposed to the attacker.\nI:N - No memory corruption, arbitrary write, or code execution primitive is created; impact is limited to resource exhaustion and I/O failure.\nA:H - Each triggering completion permanently exhausts the single-element dmavec mempool, causing persistent BLK_STS_RESOURCE failures that deny subsequent P2P and non-IOVA PRP I/O on the affected NVMe controller until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:16.638Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24ea0de233d9ebb5ebd6f6018eaf2084af25e3dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/85686c72966c5ee637893f124ddb31a1cace7bee"
        }
      ],
      "title": "nvme-pci: fix dma_vecs leak on p2p memory",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64020",
    "datePublished": "2026-07-19T15:39:14.115Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-05T12:38:16.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64020",
      "date": "2026-09-21",
      "epss": "0.00344",
      "percentile": "0.27897"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/host/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "24ea0de233d9ebb5ebd6f6018eaf2084af25e3dd",
                    "status": "affected",
                    "version": "b8b7570a7ec872f2a27b775c4f8710ca8a357adf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "85686c72966c5ee637893f124ddb31a1cace7bee",
                    "status": "affected",
                    "version": "b8b7570a7ec872f2a27b775c4f8710ca8a357adf",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/host/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix dma_vecs leak on p2p memory\n\nWe don\u0027t unmap P2P memory, so we don\u0027t need to track it. The dma_vec\nallocation was getting leaked on the completion."
          }
        ],
        "id": "CVE-2026-64020",
        "lastModified": "2026-07-30T14:59:47.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:42.007",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/24ea0de233d9ebb5ebd6f6018eaf2084af25e3dd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/85686c72966c5ee637893f124ddb31a1cace7bee"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T17:41:46+00:00",
      "cve": "CVE-2026-64020",
      "id": "CVE-2026-64020",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvme-pci: fix dma_vecs leak on p2p memory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64020.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-07T23:45:35Z",
      "cve": "CVE-2026-64020",
      "id": "CVE-2026-64020",
      "initial_release_date": "2026-07-21T13:01:23Z",
      "product_status:known_not_affected": "274",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64020",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64020.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.