CVE-2026-64071: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64071 Overview

CVE-2026-64071 is a use-after-free vulnerability in the Linux kernel's NVMe PCI driver. The flaw resides in the nvme_free_host_mem() function, which frees dev->hmb_sgt via dma_free_noncontiguous() but fails to clear the pointer afterward. When the function is invoked a second time along an error path, the driver dereferences the stale pointer and triggers a NULL pointer dereference inside iommu_dma_free_noncontiguous().

The issue was observed on Thunderbolt-attached NVMe devices where PCIe link instability causes intermittent I/O errors during Host Memory Buffer (HMB) setup. The condition results in a kernel crash during nvme_probe().

Critical Impact
Local attackers or unstable hardware conditions can trigger a kernel NULL pointer dereference, causing a denial-of-service crash of the affected host.

Affected Products

Linux kernel versions containing the vulnerable nvme-pci driver prior to the fix commits
Systems using NVMe devices that negotiate a Host Memory Buffer (HMB)
Thunderbolt-attached NVMe enclosures where PCIe link instability increases exposure

Discovery Timeline

2026-07-19 - CVE-2026-64071 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64071

Vulnerability Analysis

The defect is a classic use-after-free [CWE-416] triggered by improper cleanup of a DMA scatter-gather table pointer. During nvme_probe(), the driver calls nvme_setup_host_mem() to allocate the Host Memory Buffer. If nvme_alloc_host_mem_single() succeeds and populates dev->hmb_sgt, but the subsequent nvme_set_host_mem() command fails with -EIO, the driver invokes nvme_free_host_mem() to release the allocation.

nvme_free_host_mem() calls dma_free_noncontiguous() on dev->hmb_sgt but leaves the pointer intact. When the outer nvme_probe() error path calls nvme_free_host_mem() a second time, the function operates on the stale pointer. The path leads into iommu_dma_free_noncontiguous(), which dereferences sgt->sgl->dma_address at offset 0x10, resulting in a kernel NULL pointer dereference.

Root Cause

The root cause is missing pointer nullification after freeing a DMA resource. The function releases the backing memory but does not set dev->hmb_sgt = NULL, breaking the invariant that guards the double-free error path. The fix explicitly assigns NULL to dev->hmb_sgt after freeing, which routes the second call into the multi-descriptor branch that safely handles the already-cleaned state.

Attack Vector

Exploitation requires triggering an I/O error during HMB negotiation on nvme_probe(). This condition is reproducible on Thunderbolt-attached NVMe enclosures such as an OWC Envoy Express behind a Dell WD22TB4 dock, where PCIe link instability intermittently returns errors. A local attacker with the ability to hot-plug NVMe hardware or induce PCIe link renegotiation can crash the kernel and cause a denial of service.

No verified public exploit code is available. Kernel stack traces published in the upstream commit show the crash path through nvme_free_host_mem+0x30/0xf0 into dma_free_noncontiguous+0x3b/0x130 and iommu_dma_free_noncontiguous+0x22/0x80. Refer to the upstream fix commit for the exact source-level change.

Detection Methods for CVE-2026-64071

Indicators of Compromise

Kernel oops messages referencing iommu_dma_free_noncontiguous+0x22/0x80 and nvme_free_host_mem+0x30/0xf0
BUG: kernel NULL pointer dereference, address: 0000000000000010 entries in dmesg or journalctl -k
Repeated nvme_probe failures on hot-plug or resume events for Thunderbolt or PCIe NVMe devices

Detection Strategies

Parse kernel ring buffers for the specific call trace signature involving nvme_free_host_mem followed by dma_free_noncontiguous
Correlate NVMe I/O errors during device probe with subsequent kernel panics or soft lockups
Track kernel version inventory to identify hosts running unpatched nvme-pci code

Monitoring Recommendations

Forward /var/log/kern.log and journald kernel facility entries to a centralized log analytics platform
Alert on any process crash originating from nvme module frames in kernel backtraces
Monitor Thunderbolt and hot-plug PCIe events on endpoints and workstations where external NVMe storage is common

How to Mitigate CVE-2026-64071

Immediate Actions Required

Apply the upstream Linux kernel patch that sets dev->hmb_sgt = NULL inside nvme_free_host_mem() on all affected systems
Update distribution kernels to a release that incorporates the stable tree fix commits
Restrict physical access to Thunderbolt and USB4 ports on systems where external NVMe enclosures are not required

Patch Information

The fix has been merged into the mainline and stable kernel trees. Reference commits: 7c89f474005d, 9525e3a6fbb1, and b35a13036755. Rebuild or install a kernel package that includes these commits and reboot affected hosts.

Workarounds

Disable Host Memory Buffer support for affected NVMe controllers via the nvme_core.max_host_mem_size_mb=0 module parameter where supported
Avoid connecting NVMe storage through Thunderbolt docks that exhibit PCIe link instability
Blocklist the nvme module on systems where external NVMe hot-plug is not required until the patched kernel is deployed

bash

# Configuration example: verify the running kernel includes the fix
uname -r
# Inspect kernel logs for the vulnerable call trace
journalctl -k | grep -E 'nvme_free_host_mem|iommu_dma_free_noncontiguous'
# Optionally disable HMB via kernel command line (add to GRUB_CMDLINE_LINUX)
# nvme_core.max_host_mem_size_mb=0