CVE-2026-64071

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel NVMe PCI Subsystem

Publication date: 2026-07-19

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix use-after-free in nvme_free_host_mem() nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous() but never clears the pointer afterward. This leads to a use-after-free if nvme_free_host_mem() is called twice in the same error path. This can happen during nvme_probe() when nvme_setup_host_mem() succeeds in allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem() fails with an I/O error: nvme_setup_host_mem() nvme_alloc_host_mem_single() -> sets dev->hmb_sgt nvme_set_host_mem() -> fails with -EIO nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it return error nvme_probe() error path: nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free The second call dereferences the freed sgt, causing a NULL pointer dereference in iommu_dma_free_noncontiguous() when it accesses sgt->sgl->dma_address (the backing memory has been freed and zeroed). This is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC Envoy Express behind a Dell WD22TB4 dock) where the device intermittently returns I/O errors during HMB setup due to PCIe link instability. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80 Call Trace: <TASK> dma_free_noncontiguous+0x3b/0x130 nvme_free_host_mem+0x30/0xf0 [nvme] nvme_probe.cold+0xcc/0x275 [nvme] local_pci_probe+0x43/0xa0 pci_device_probe+0xeea/0x290 really_probe+0xf9/0x3b0 __driver_probe_device+0x8b/0x170 driver_probe_device+0x24/0xd0 __driver_attach_async_helper+0x6b/0x110 async_run_entry_fn+0x37/0x170 process_one_work+0x1ac/0x3d0 worker_thread+0x1b8/0x360 kthread+0xf7/0x130 ret_from_fork+0x2d8/0x3a0 ret_from_fork_asm+0x1a/0x30 </TASK> Fix this by setting dev->hmb_sgt to NULL after freeing it, so the second call takes the multi-descriptor path which safely handles the already-cleaned-up state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-09-03

Generated

2026-09-18

AI Q&A

2026-07-19

EPSS Evaluated

2026-09-15

NVD

CVE-2026-64071

EUVD

EUVD-2026-45644

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's NVMe PCI driver. It occurs when nvme_free_host_mem() frees memory but fails to clear a pointer, leading to a second free attempt that dereferences already freed memory. This happens during error handling in nvme_probe() when device setup fails after partial allocation.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe driver and may not have direct network detection methods. Check kernel logs for NULL pointer dereference errors related to nvme or iommu_dma_free_noncontiguous. Use commands like dmesg | grep -i 'nvme\|iommu\|NULL pointer' to search for related errors.

Impact Analysis

This could cause system crashes or instability if triggered, particularly on Thunderbolt-attached NVMe devices where PCIe link issues may cause intermittent I/O errors during setup. The crash manifests as a kernel NULL pointer dereference.

Compliance Impact

This vulnerability is a kernel-level memory corruption issue in the Linux NVMe driver that could lead to system instability or crashes. It does not directly relate to data privacy, access control, or audit logging requirements in standards like GDPR or HIPAA. Compliance impact would be indirect if the vulnerability causes system failures affecting data processing or storage systems subject to these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-64071. If using Thunderbolt-attached NVMe devices, ensure stable PCIe link conditions or consider temporarily disconnecting such devices until the kernel is updated.

Hi! I’m here to help you understand CVE-2026-64071. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70