CVE-2026-64071

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix use-after-free in nvme_free_host_mem()

nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous()

but never clears the pointer afterward. This leads to a use-after-free

if nvme_free_host_mem() is called twice in the same error path.

This can happen during nvme_probe() when nvme_setup_host_mem() succeeds

in allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem()

fails with an I/O error:

nvme_setup_host_mem()

nvme_alloc_host_mem_single() -> sets dev->hmb_sgt

nvme_set_host_mem() -> fails with -EIO

nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it

return error

nvme_probe() error path:

nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free

The second call dereferences the freed sgt, causing a NULL pointer

dereference in iommu_dma_free_noncontiguous() when it accesses

sgt->sgl->dma_address (the backing memory ha

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References