CVE-2026-64071 (GCVE-0-2026-64071)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-07-19 15:39
VLAI
Title
nvme-pci: fix use-after-free in nvme_free_host_mem()
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix use-after-free in nvme_free_host_mem() nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous() but never clears the pointer afterward. This leads to a use-after-free if nvme_free_host_mem() is called twice in the same error path. This can happen during nvme_probe() when nvme_setup_host_mem() succeeds in allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem() fails with an I/O error: nvme_setup_host_mem() nvme_alloc_host_mem_single() -> sets dev->hmb_sgt nvme_set_host_mem() -> fails with -EIO nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it return error nvme_probe() error path: nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free The second call dereferences the freed sgt, causing a NULL pointer dereference in iommu_dma_free_noncontiguous() when it accesses sgt->sgl->dma_address (the backing memory has been freed and zeroed). This is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC Envoy Express behind a Dell WD22TB4 dock) where the device intermittently returns I/O errors during HMB setup due to PCIe link instability. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80 Call Trace: <TASK> dma_free_noncontiguous+0x3b/0x130 nvme_free_host_mem+0x30/0xf0 [nvme] nvme_probe.cold+0xcc/0x275 [nvme] local_pci_probe+0x43/0xa0 pci_device_probe+0xeea/0x290 really_probe+0xf9/0x3b0 __driver_probe_device+0x8b/0x170 driver_probe_device+0x24/0xd0 __driver_attach_async_helper+0x6b/0x110 async_run_entry_fn+0x37/0x170 process_one_work+0x1ac/0x3d0 worker_thread+0x1b8/0x360 kthread+0xf7/0x130 ret_from_fork+0x2d8/0x3a0 ret_from_fork_asm+0x1a/0x30 </TASK> Fix this by setting dev->hmb_sgt to NULL after freeing it, so the second call takes the multi-descriptor path which safely handles the already-cleaned-up state.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 63a5c7a4b4c49ad86c362e9f555e6f343804ee1d , < 9525e3a6fbb1d126a22ab2ee86ddea25af581a7c (git)
Affected: 63a5c7a4b4c49ad86c362e9f555e6f343804ee1d , < 7c89f474005d8377525d2991930b7432ee193a52 (git)
Affected: 63a5c7a4b4c49ad86c362e9f555e6f343804ee1d , < b35a13036755c5803168a7cb93bc66035c3e65b8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9525e3a6fbb1d126a22ab2ee86ddea25af581a7c",
              "status": "affected",
              "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d",
              "versionType": "git"
            },
            {
              "lessThan": "7c89f474005d8377525d2991930b7432ee193a52",
              "status": "affected",
              "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d",
              "versionType": "git"
            },
            {
              "lessThan": "b35a13036755c5803168a7cb93bc66035c3e65b8",
              "status": "affected",
              "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix use-after-free in nvme_free_host_mem()\n\nnvme_free_host_mem() frees dev-\u003ehmb_sgt via dma_free_noncontiguous()\nbut never clears the pointer afterward.  This leads to a use-after-free\nif nvme_free_host_mem() is called twice in the same error path.\n\nThis can happen during nvme_probe() when nvme_setup_host_mem() succeeds\nin allocating the HMB (setting dev-\u003ehmb_sgt) but nvme_set_host_mem()\nfails with an I/O error:\n\n  nvme_setup_host_mem()\n    nvme_alloc_host_mem_single()   -\u003e sets dev-\u003ehmb_sgt\n    nvme_set_host_mem()            -\u003e fails with -EIO\n    nvme_free_host_mem()           -\u003e frees hmb_sgt, but does NOT NULL it\n    return error\n\n  nvme_probe() error path:\n    nvme_free_host_mem()           -\u003e dev-\u003ehmb_sgt is stale, use-after-free\n\nThe second call dereferences the freed sgt, causing a NULL pointer\ndereference in iommu_dma_free_noncontiguous() when it accesses\nsgt-\u003esgl-\u003edma_address (the backing memory has been freed and zeroed).\n\nThis is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC\nEnvoy Express behind a Dell WD22TB4 dock) where the device intermittently\nreturns I/O errors during HMB setup due to PCIe link instability.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80\n Call Trace:\n  \u003cTASK\u003e\n  dma_free_noncontiguous+0x3b/0x130\n  nvme_free_host_mem+0x30/0xf0 [nvme]\n  nvme_probe.cold+0xcc/0x275 [nvme]\n  local_pci_probe+0x43/0xa0\n  pci_device_probe+0xeea/0x290\n  really_probe+0xf9/0x3b0\n  __driver_probe_device+0x8b/0x170\n  driver_probe_device+0x24/0xd0\n  __driver_attach_async_helper+0x6b/0x110\n  async_run_entry_fn+0x37/0x170\n  process_one_work+0x1ac/0x3d0\n  worker_thread+0x1b8/0x360\n  kthread+0xf7/0x130\n  ret_from_fork+0x2d8/0x3a0\n  ret_from_fork_asm+0x1a/0x30\n  \u003c/TASK\u003e\n\nFix this by setting dev-\u003ehmb_sgt to NULL after freeing it, so the\nsecond call takes the multi-descriptor path which safely handles the\nalready-cleaned-up state."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T15:39:47.162Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9525e3a6fbb1d126a22ab2ee86ddea25af581a7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c89f474005d8377525d2991930b7432ee193a52"
        },
        {
          "url": "https://git.kernel.org/stable/c/b35a13036755c5803168a7cb93bc66035c3e65b8"
        }
      ],
      "title": "nvme-pci: fix use-after-free in nvme_free_host_mem()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64071",
    "datePublished": "2026-07-19T15:39:47.162Z",
    "dateReserved": "2026-07-19T07:54:57.031Z",
    "dateUpdated": "2026-07-19T15:39:47.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64071",
      "date": "2026-09-21",
      "epss": "0.00133",
      "percentile": "0.03185"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/host/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9525e3a6fbb1d126a22ab2ee86ddea25af581a7c",
                    "status": "affected",
                    "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7c89f474005d8377525d2991930b7432ee193a52",
                    "status": "affected",
                    "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b35a13036755c5803168a7cb93bc66035c3e65b8",
                    "status": "affected",
                    "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/host/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.13"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0",
                    "versionEndExcluding": "6.18.34",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix use-after-free in nvme_free_host_mem()\n\nnvme_free_host_mem() frees dev-\u003ehmb_sgt via dma_free_noncontiguous()\nbut never clears the pointer afterward.  This leads to a use-after-free\nif nvme_free_host_mem() is called twice in the same error path.\n\nThis can happen during nvme_probe() when nvme_setup_host_mem() succeeds\nin allocating the HMB (setting dev-\u003ehmb_sgt) but nvme_set_host_mem()\nfails with an I/O error:\n\n  nvme_setup_host_mem()\n    nvme_alloc_host_mem_single()   -\u003e sets dev-\u003ehmb_sgt\n    nvme_set_host_mem()            -\u003e fails with -EIO\n    nvme_free_host_mem()           -\u003e frees hmb_sgt, but does NOT NULL it\n    return error\n\n  nvme_probe() error path:\n    nvme_free_host_mem()           -\u003e dev-\u003ehmb_sgt is stale, use-after-free\n\nThe second call dereferences the freed sgt, causing a NULL pointer\ndereference in iommu_dma_free_noncontiguous() when it accesses\nsgt-\u003esgl-\u003edma_address (the backing memory has been freed and zeroed).\n\nThis is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC\nEnvoy Express behind a Dell WD22TB4 dock) where the device intermittently\nreturns I/O errors during HMB setup due to PCIe link instability.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80\n Call Trace:\n  \u003cTASK\u003e\n  dma_free_noncontiguous+0x3b/0x130\n  nvme_free_host_mem+0x30/0xf0 [nvme]\n  nvme_probe.cold+0xcc/0x275 [nvme]\n  local_pci_probe+0x43/0xa0\n  pci_device_probe+0xeea/0x290\n  really_probe+0xf9/0x3b0\n  __driver_probe_device+0x8b/0x170\n  driver_probe_device+0x24/0xd0\n  __driver_attach_async_helper+0x6b/0x110\n  async_run_entry_fn+0x37/0x170\n  process_one_work+0x1ac/0x3d0\n  worker_thread+0x1b8/0x360\n  kthread+0xf7/0x130\n  ret_from_fork+0x2d8/0x3a0\n  ret_from_fork_asm+0x1a/0x30\n  \u003c/TASK\u003e\n\nFix this by setting dev-\u003ehmb_sgt to NULL after freeing it, so the\nsecond call takes the multi-descriptor path which safely handles the\nalready-cleaned-up state."
          }
        ],
        "id": "CVE-2026-64071",
        "lastModified": "2026-09-03T14:54:13.197",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-07-19T16:17:47.687",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7c89f474005d8377525d2991930b7432ee193a52"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9525e3a6fbb1d126a22ab2ee86ddea25af581a7c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b35a13036755c5803168a7cb93bc66035c3e65b8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-03T15:31:28+00:00",
      "cve": "CVE-2026-64071",
      "id": "CVE-2026-64071",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvme-pci: fix use-after-free in nvme_free_host_mem()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64071.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:23:13Z",
      "cve": "CVE-2026-64071",
      "id": "CVE-2026-64071",
      "initial_release_date": "2026-07-21T13:00:14Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "345",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64071",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64071.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.