CVE-2026-64071: nvme-pci: fix use-after-free in nvme_free_host_mem()
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix use-after-free in nvmefreehostmem()
nvmefreehostmem() frees dev->hmbsgt via dmafreenoncontiguous() but never clears the pointer afterward. This leads to a use-after-free if nvmefreehostmem() is called twice in the same error path.
This can happen during nvmeprobe() when nvmesetuphostmem() succeeds in allocating the HMB (setting dev->hmbsgt) but nvmesethostmem() fails with an I/O error:
nvmesetuphostmem() nvmeallochostmemsingle() -> sets dev->hmbsgt nvmesethostmem() -> fails with -EIO nvmefreehostmem() -> frees hmbsgt, but does NOT NULL it return error
nvmeprobe() error path: nvmefreehostmem() -> dev->hmbsgt is stale, use-after-free
The second call dereferences the freed sgt, causing a NULL pointer dereference in iommudmafreenoncontiguous() when it accesses sgt->sgl->dmaaddress (the backing memory has been freed and zeroed).
This is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC Envoy Express behind a Dell WD22TB4 dock) where the device intermittently returns I/O errors during HMB setup due to PCIe link instability.
BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:iommudmafreenoncontiguous+0x22/0x80 Call Trace: <TASK> dmafreenoncontiguous+0x3b/0x130 nvmefreehostmem+0x30/0xf0 [nvme] nvmeprobe.cold+0xcc/0x275 [nvme] localpciprobe+0x43/0xa0 pcideviceprobe+0xeea/0x290 reallyprobe+0xf9/0x3b0 driverprobedevice+0x8b/0x170 driverprobedevice+0x24/0xd0 driverattachasynchelper+0x6b/0x110 asyncrunentryfn+0x37/0x170 processonework+0x1ac/0x3d0 workerthread+0x1b8/0x360 kthread+0xf7/0x130 retfromfork+0x2d8/0x3a0 retfromforkasm+0x1a/0x30 </TASK>
Fix this by setting dev->hmbsgt to NULL after freeing it, so the second call takes the multi-descriptor path which safely handles the already-cleaned-up state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the nvme free_host_mem() error path, after freeing dev->hmb_sgt, set dev->hmb_sgt = NULL so iommu_dma_free_noncontiguous() does not dereference a freed/stale sgt.
Linux kernel (nvme driver) dev->hmb_sgt (NULL after free) = NULL
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
A local attacker or user needs an NVMe device path that reaches host memory buffer setup, successfully allocates the HMB, and then encounters an I/O error while setting that memory. The subsequent probe error handling must call the host-memory cleanup routine twice.
Which systems are most likely to encounter the failure in practice?
The issue is reproducible with Thunderbolt-attached NVMe devices when PCIe link instability causes intermittent I/O errors during HMB setup. The provided example is an OWC Envoy Express connected through a Dell WD22TB4 dock.
What is the likely impact when the vulnerable error path is reached?
The stale HMB scatter-gather pointer is freed a second time and dereferenced by the DMA cleanup path. This results in a kernel NULL pointer dereference, with confidentiality, integrity, and availability impacts rated high in the supplied CVSS vector.