CVE-2026-64019: Linux Kernel Privilege Escalation Flaw

CVE-2026-64019 Overview

CVE-2026-64019 is a memory leak vulnerability in the Linux kernel's nvme-pci driver. The flaw involves the leaking of initial Direct Memory Access (DMA) mappings during iteration when the driver fails to allocate the tracking descriptor for both Physical Region Page (PRP) and Scatter Gather List (SGL) data structures. Mappings also leak when the driver detects an invalid bio_vec during PRP mapping. The issue has been resolved upstream through two kernel commits that add a dedicated unmap path for in-use iterators.

Critical Impact
Repeated failure paths in the NVMe PCI driver can exhaust DMA mapping resources over time, degrading storage subsystem reliability on affected Linux systems.

Affected Products

Linux kernel nvme-pci driver
Systems using NVMe over PCIe storage
Distributions shipping vulnerable stable kernel branches (see kernel.org stable tree)

Discovery Timeline

2026-07-19 - CVE-2026-64019 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64019

Vulnerability Analysis

The vulnerability resides in the nvme-pci driver's data setup logic. When the driver iterates through I/O request segments to build PRP or SGL descriptors, it establishes DMA mappings for each segment. If the allocation of the tracking descriptor fails mid-iteration, the driver returns an error without unmapping the initial DMA mapping. This is classified as a Memory Leak vulnerability affecting kernel resource management.

The existing unmap helper cannot be reused on the error path because it depends on the tracking descriptor being successfully allocated. A parallel leak path exists when the driver encounters an invalid bio_vec while mapping PRPs. In both cases, DMA-mapped resources remain allocated after the operation returns failure.

Root Cause

The root cause is an incomplete error-handling path in the NVMe PCI data setup routine. The cleanup logic assumes successful descriptor allocation, so failure prior to that step bypasses unmap operations. The fix introduces a new unmap function that operates directly on an in-use iterator, enabling correct cleanup regardless of descriptor allocation state.

Attack Vector

This is a local kernel-space defect triggered under I/O error conditions rather than a remotely reachable attack surface. Exploitation requires the driver to enter the failure path repeatedly, either through resource pressure that causes descriptor allocation failures or through malformed I/O producing invalid bio_vec entries. Sustained triggering leaks DMA mappings and consumes IOMMU or swiotlb resources.

No verified proof-of-concept code is available. See the kernel commits 1bf86336e4b6 and e50db059ec8e for the authoritative patch source.

Detection Methods for CVE-2026-64019

Indicators of Compromise

Growing DMA mapping counts reported via /proc/meminfo or IOMMU statistics without corresponding freed mappings
Kernel log messages from nvme-pci reporting failed descriptor allocations or invalid bio_vec errors
Progressive degradation of NVMe I/O performance on long-running hosts

Detection Strategies

Compare the running kernel version against the fixed commits on the stable tree using uname -r and distribution changelog data
Monitor dmesg output for nvme subsystem allocation failures during heavy I/O workloads
Track swiotlb slab usage on systems using bounce buffers to detect abnormal growth

Monitoring Recommendations

Instrument NVMe I/O error counters via nvme-cli and /sys/block/nvme*/stat for anomalous error rates
Alert on kernel messages containing nvme and dma keywords using centralized log collection
Baseline DMA mapping consumption on healthy hosts and alert on sustained upward drift

How to Mitigate CVE-2026-64019

Immediate Actions Required

Update to a Linux kernel version containing commits 1bf86336e4b6 and e50db059ec8e
Coordinate with your Linux distribution vendor for backported stable kernel packages
Reboot affected hosts after kernel upgrade to activate the patched nvme-pci driver

Patch Information

The fix is delivered through two upstream commits in the Linux kernel stable tree. Commit 1bf86336e4b6cf40873fda47a7fe191446864937 and commit e50db059ec8e63bc50b1cc039e2502cb5ea75a70 introduce a dedicated unmap function for in-use iterators and correct the invalid bio_vec leak path. Apply the patched kernel from your distribution or rebuild from the stable branch.

Workarounds

Reduce I/O pressure on affected hosts to lower the probability of descriptor allocation failures
Schedule periodic reboots on unpatched systems to reclaim leaked DMA mappings until an update is applied
Validate storage stack health after any NVMe error events and drain workloads from suspect hosts

bash

# Verify running kernel and NVMe driver version
uname -r
modinfo nvme | grep -E '^(version|srcversion|filename)'

# Check for recent nvme-pci errors
dmesg | grep -iE 'nvme|dma' | tail -n 50