CVE-2026-64019: nvme-pci: fix dma mapping leak on data setup error
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix dma mapping leak on data setup error
We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing unmap helper because it depends on the tracking descriptor being successfully allocated, so a new one for an in-use iterator is provided.
The mappings were also leaking when the driver detects an invalid biovec when mapping PRPs, so fix that too.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In nvme-pci data setup, unmap the initial DMA mapping when allocation of the tracking descriptor fails during PRP or SGL iteration, and unmap the bio_vec mapping when mapping PRPs fails; use a direct iterator unmap for an in-use iterator because the existing unmap helper requires a successfully allocated tracking descriptor.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64019?
CVE-2026-64019 has a risk score of 17, indicating a serious vulnerability.
What type of vulnerability is CVE-2026-64019?
CVE-2026-64019 is a vulnerability related to DMA mapping leaks in the nvme-pci driver of the Linux kernel.
How do I fix CVE-2026-64019?
To fix CVE-2026-64019, you should update your Linux kernel to the latest patched version.
What impact does CVE-2026-64019 have on system performance?
CVE-2026-64019 may lead to memory leaks which can degrade system performance over time.
Is CVE-2026-64019 exploit-related to storage devices?
Yes, CVE-2026-64019 affects the NVMe PCI subsystem, which is related to storage device performance and memory management.