PT-2026-61388 · Linux · Linux
CVE-2026-64071
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix use-after-free in nvme free host mem()
nvme free host mem() frees dev->hmb sgt via dma free noncontiguous()
but never clears the pointer afterward. This leads to a use-after-free
if nvme free host mem() is called twice in the same error path.
This can happen during nvme probe() when nvme setup host mem() succeeds
in allocating the HMB (setting dev->hmb sgt) but nvme set host mem()
fails with an I/O error:
nvme setup host mem()
nvme alloc host mem single() -> sets dev->hmb sgt
nvme set host mem() -> fails with -EIO
nvme free host mem() -> frees hmb sgt, but does NOT NULL it
return error
nvme probe() error path:
nvme free host mem() -> dev->hmb sgt is stale, use-after-free
The second call dereferences the freed sgt, causing a NULL pointer
dereference in iommu dma free noncontiguous() when it accesses
sgt->sgl->dma address (the backing memory has been freed and zeroed).
This is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC
Envoy Express behind a Dell WD22TB4 dock) where the device intermittently
returns I/O errors during HMB setup due to PCIe link instability.
BUG: kernel NULL pointer dereference, address: 0000000000000010
RIP: 0010:iommu dma free noncontiguous+0x22/0x80
Call Trace:
dma free noncontiguous+0x3b/0x130
nvme free host mem+0x30/0xf0 [nvme]
nvme probe.cold+0xcc/0x275 [nvme]
local pci probe+0x43/0xa0
pci device probe+0xeea/0x290
really probe+0xf9/0x3b0
driver probe device+0x8b/0x170
driver probe device+0x24/0xd0
driver attach async helper+0x6b/0x110
async run entry fn+0x37/0x170
process one work+0x1ac/0x3d0
worker thread+0x1b8/0x360
kthread+0xf7/0x130
ret from fork+0x2d8/0x3a0
ret from fork asm+0x1a/0x30
Fix this by setting dev->hmb sgt to NULL after freeing it, so the
second call takes the multi-descriptor path which safely handles the
already-cleaned-up state.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux