CVE-2026-64071 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix use-after-free in nvme_free_host_mem()
nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous() but never clears the pointer afterward. This leads to a use-after-free if nvme_free_host_mem() is called twice in the same error path.
This can happen during nvme_probe() when nvme_setup_host_mem() succeeds in allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem() fails with an I/O error:
nvme_setup_host_mem() nvme_alloc_host_mem_single() -> sets dev->hmb_sgt nvme_set_host_mem() -> fails with -EIO nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it return error
nvme_probe() error path: nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free
The second call dereferences the freed sgt, causing a NULL pointer dereference in iommu_dma_free_noncontiguous() when it accesses sgt->sgl->dma_address (the backing memory has been freed and zeroed).
This is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC Envoy Express behind a Dell WD22TB4 dock) where the device intermittently returns I/O errors during HMB setup due to PCIe link instability.
BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80 Call Trace: <TASK> dma_free_noncontiguous+0x3b/0x130 nvme_free_host_mem+0x30/0xf0 [nvme]
nvme_probe.cold+0xcc/0x275 [nvme]
local_pci_probe+0x43/0xa0 pci_device_probe+0xeea/0x290 really_probe+0xf9/0x3b0 __driver_probe_device+0x8b/0x170 driver_probe_device+0x24/0xd0 __driver_attach_async_helper+0x6b/0x110 async_run_entry_fn+0x37/0x170 process_one_work+0x1ac/0x3d0 worker_thread+0x1b8/0x360 kthread+0xf7/0x130 ret_from_fork+0x2d8/0x3a0 ret_from_fork_asm+0x1a/0x30 </TASK>
Fix this by setting dev->hmb_sgt to NULL after freeing it, so the second call takes the multi-descriptor path which safely handles the already-cleaned-up state.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability described represents a critical use-after-free condition in the Linux kernel's NVMe PCI driver, specifically within the nvme_free_host_mem() function. This flaw arises from improper memory management practices where the device's host memory structure pointer is freed but not subsequently nullified, creating a persistent reference to deallocated memory. The issue manifests during NVMe device probe operations when the host memory setup process encounters an I/O error after successfully allocating host memory structures but failing during the subsequent host memory configuration phase.
The technical implementation of this vulnerability stems from the nvme_setup_host_mem() function correctly initializing dev->hmb_sgt with a valid memory allocation, followed by nvme_set_host_mem() failing with an I/O error condition. During the error handling path, nvme_free_host_mem() executes and properly frees the dma memory via dma_free_noncontiguous(), yet fails to clear the dev->hmb_sgt pointer reference. This creates a dangerous scenario where subsequent calls to nvme_free_host_mem() during the same error path will attempt to operate on the freed memory structure. The vulnerability is particularly relevant in environments with unstable PCIe connections such as Thunderbolt-attached NVMe devices, where intermittent I/O errors commonly occur during host memory setup operations.
The operational impact of this vulnerability extends beyond simple kernel crashes, representing a potential security risk through kernel memory corruption that could be exploited by malicious actors. When the second invocation of nvme_free_host_mem() occurs, it attempts to dereference the stale dev->hmb_sgt pointer, leading to a NULL pointer dereference in iommu_dma_free_noncontiguous() function when accessing sgt->sgl->dma_address. This results in a kernel panic and system instability, effectively creating a denial-of-service condition that compromises system availability. The vulnerability is particularly concerning for enterprise storage systems relying on NVMe over PCIe interfaces where such intermittent connection issues are common.
The fix implemented addresses this issue by ensuring that dev->hmb_sgt is explicitly set to NULL following memory deallocation in nvme_free_host_mem(). This prevents subsequent calls from attempting to operate on freed memory structures and ensures proper handling through the multi-descriptor path which safely manages already-cleaned-up state. This remediation aligns with established security practices for preventing use-after-free vulnerabilities and follows the CWE-416 principle of properly managing memory lifecycle operations. The solution also corresponds to ATT&CK technique T1059.008 for kernel-mode rootkits, as it prevents potential exploitation through memory corruption techniques that could be leveraged by attackers to escalate privileges or compromise system integrity during device initialization phases.