CVE-2026-64020 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix dma_vecs leak on p2p memory
We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel nvme-pci driver represents a memory management issue that occurs when handling peer-to-peer memory operations within NVMe storage controllers. This flaw specifically affects systems utilizing NVMe over PCIe interfaces where direct memory access operations involve peer-to-peer memory mappings. The root cause lies in improper resource cleanup mechanisms within the driver's completion handling code path, creating a memory leak scenario that can accumulate over time and potentially impact system performance and stability.
The technical implementation flaw stems from the driver's failure to properly manage DMA vector allocations when processing peer-to-peer memory operations. When P2P memory mappings are established, the kernel allocates DMA vectors to track these memory regions for direct access operations. However, during normal completion processing, the code path fails to properly unmap or release these P2P memory regions, resulting in the dma_vec structures remaining allocated in memory. This represents a classic resource leak pattern that can occur when memory management routines do not account for all possible execution paths through the code.
The operational impact of this vulnerability manifests as progressive memory consumption within the kernel's NVMe subsystem, particularly affecting systems with high I/O throughput or those utilizing peer-to-peer memory features extensively. The leak occurs during normal completion processing of NVMe commands that involve P2P memory operations, meaning it can accumulate over time without explicit intervention. While individual leaks may be small, repeated occurrences across multiple I/O operations can lead to significant memory pressure, potentially causing system slowdowns or even memory exhaustion in extreme scenarios. This vulnerability affects systems running Linux kernel versions where the nvme-pci driver handles P2P memory operations without proper cleanup mechanisms.
The fix implemented addresses this issue by recognizing that P2P memory mappings do not require DMA vector tracking since they are already properly managed through the peer-to-peer subsystem. The solution involves modifying the completion handling code to skip DMA vector allocation and management for P2P memory operations, thereby preventing the leak while maintaining proper functionality. This approach aligns with standard kernel memory management practices where unnecessary resource allocations are avoided when higher-level subsystems already handle the required tracking. The fix demonstrates proper adherence to security principles by ensuring complete resource cleanup during all code execution paths and prevents potential denial of service scenarios through memory exhaustion.
This vulnerability type falls under CWE-401: "Improper Release of Memory Before Removing Last Reference" and represents a failure in proper resource lifecycle management within kernel space drivers. The issue can be mapped to ATT&CK technique T1490: "Inhibit System Recovery" as the memory leak could potentially lead to system instability or performance degradation that affects system availability. The fix ensures proper memory management compliance with Linux kernel security requirements and demonstrates the importance of comprehensive resource cleanup in high-performance storage subsystems where memory efficiency directly impacts overall system performance and reliability.
The resolution of this vulnerability through targeted code modification reflects standard practices for maintaining kernel driver stability and preventing resource leaks that could impact long-running systems. By eliminating unnecessary DMA vector tracking for P2P memory operations, the fix maintains functional correctness while preventing the accumulation of leaked resources that could otherwise degrade system performance over time. This approach ensures proper adherence to Linux kernel memory management best practices and demonstrates effective vulnerability remediation through careful analysis of resource usage patterns within storage driver subsystems.