CVE-2026-64020: Linux Kernel Information Disclosure Flaw

CVE-2026-64020 Overview

CVE-2026-64020 is a memory leak vulnerability in the Linux kernel's NVMe over PCIe (nvme-pci) driver. The flaw resides in the handling of peer-to-peer (P2P) memory during I/O completion. The driver allocates a dma_vec structure for tracking DMA mappings but fails to release it when P2P memory is used, because P2P memory is never unmapped and therefore should not require tracking.

Repeated I/O operations against NVMe devices using P2P memory progressively exhaust kernel memory. The condition can lead to resource exhaustion and denial of service on affected systems.

Critical Impact
Attackers or workloads leveraging NVMe P2P DMA can trigger progressive kernel memory exhaustion, degrading system availability without requiring authentication.

Affected Products

Linux kernel versions containing the nvme-pci P2P memory handling code prior to commit 85686c72966c
Systems using NVMe devices configured with peer-to-peer DMA
Distributions shipping the vulnerable nvme-pci driver

Discovery Timeline

2026-07-19 - CVE-2026-64020 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64020

Vulnerability Analysis

The nvme-pci driver uses dma_vec structures to record DMA mappings created for a given I/O request. On completion, the driver walks these vectors to unmap the corresponding memory regions. P2P memory follows a different lifecycle because it is not DMA-mapped in the traditional sense and does not require an unmap step.

The vulnerable code path still allocated a dma_vec entry for P2P transfers. Because the completion handler skips the unmap logic for P2P memory, the associated dma_vec allocation is never freed. Each qualifying I/O leaks memory in kernel space.

Exploitation does not require code execution or elevated privileges on the initiator side. Any workload that issues NVMe I/O over P2P memory contributes to the leak.

Root Cause

The root cause is a mismatch between allocation and release paths. The driver conditionally skips unmapping for P2P memory but unconditionally allocates a tracking vector. The fix removes the unnecessary dma_vec allocation for P2P transfers, ensuring nothing is tracked because nothing must be released.

Attack Vector

The leak accumulates in unswappable kernel memory. Sustained NVMe P2P I/O drives available memory toward zero, at which point the kernel invokes the OOM killer or halts progress on memory-dependent subsystems. Multi-tenant hosts, GPU-direct storage deployments, and high-throughput database systems are the most exposed.

The vulnerability requires no user interaction and can be triggered remotely if a network-facing service performs NVMe I/O on behalf of clients, which aligns with the network attack vector in the published CVSS metrics.

No public exploit code is required to trigger the condition. Refer to the upstream fix in the kernel commit for the exact code path.

Detection Methods for CVE-2026-64020

Indicators of Compromise

Steady growth in kernel Slab and SUnreclaim values reported in /proc/meminfo on systems with active NVMe P2P workloads
Increasing allocation counts for NVMe-related slab caches visible in /proc/slabinfo
Out-of-memory (OOM) killer events on hosts running unpatched nvme-pci drivers with P2P DMA enabled

Detection Strategies

Correlate NVMe I/O volume with kernel memory growth over time using host telemetry
Compare kernel versions against the fixed commits 24ea0de233d9 and 85686c72966c to identify unpatched hosts
Monitor dmesg for NVMe controller resets or allocation failures that follow prolonged uptime

Monitoring Recommendations

Baseline slab memory usage on NVMe-heavy hosts and alert on sustained upward drift
Track kernel version inventory to surface systems still running vulnerable nvme-pci code
Enable process and system telemetry collection on Linux endpoints to detect availability-impacting anomalies

How to Mitigate CVE-2026-64020

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 24ea0de233d9 and 85686c72966c
Prioritize patching hosts that use NVMe P2P DMA, including GPU-direct storage and high-throughput database systems
Schedule reboots for kernel updates and validate NVMe functionality after rollout

Patch Information

The fix is present in the Linux stable tree. The upstream commit removes the dma_vec allocation for P2P memory paths in the nvme-pci driver. Reference the primary fix commit and the companion stable backport. Distribution vendors are expected to backport these commits into their supported kernels.

Workarounds

Disable NVMe peer-to-peer DMA on affected hosts until the patched kernel is deployed
Reduce host uptime through scheduled reboots to reclaim leaked kernel memory
Constrain workloads that issue P2P NVMe I/O on unpatched systems to limit leak accumulation

bash

# Verify kernel version and check for the fix commit
uname -r
git -C /path/to/linux log --oneline | grep -E '24ea0de233d9|85686c72966c'

# Monitor kernel slab memory growth over time
watch -n 60 'grep -E "Slab|SUnreclaim" /proc/meminfo'