CVE-2026-64019
Received Received - Intake

DMA Mapping Leak in Linux Kernel NVMe-PCI Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing unmap helper because it depends on the tracking descriptor being successfully allocated, so a new one for an in-use iterator is provided. The mappings were also leaking when the driver detects an invalid bio_vec when mapping PRPs, so fix that too.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64019
EUVD
EUVD-2026-45592

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a DMA mapping leak in the nvme-pci driver. When setting up data, if the driver fails to allocate a tracking descriptor for PRP or SGL, the initial DMA mapping is not properly released, causing a memory leak. Additionally, mappings leak when the driver detects an invalid bio_vec during PRP mapping.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe PCI driver and involves DMA mapping leaks during error conditions. Detection would require kernel-level monitoring for DMA mapping failures or leaks in the NVMe subsystem. Check kernel logs for NVMe-related errors or warnings using commands like dmesg | grep nvme or journalctl -k | grep nvme. If you suspect exploitation, inspect DMA mapping logs or use kernel tracing tools like ftrace or perf to monitor NVMe driver behavior.

Impact Analysis

This vulnerability could lead to resource exhaustion, such as memory or DMA channels, potentially causing system instability or crashes. It may also result in performance degradation due to leaked resources not being available for other operations.

Compliance Impact

This vulnerability involves a DMA mapping leak in the Linux kernel's nvme-pci driver, which could lead to memory corruption or resource exhaustion. While it does not directly impact data confidentiality or integrity, such low-level memory issues may indirectly affect system stability and security controls required by standards like GDPR or HIPAA.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the DMA mapping leak in the nvme-pci driver. Monitor system logs for nvme-related errors indicating mapping failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64019. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart