CVE-2026-64072 Overview
CVE-2026-64072 is a memory leak vulnerability in the Linux kernel's NVMe (Non-Volatile Memory Express) subsystem. The flaw occurs in the block I/O (bio) handling path when integrity mapping fails. The local bio pointer is always NULL in the affected code path, causing the actual bio structure attached to the request to leak whenever the integrity mapping operation fails. The fix retrieves the bio directly from the request instead of relying on the local variable. This vulnerability affects kernel builds with NVMe integrity support enabled.
Critical Impact
Repeated integrity mapping failures on NVMe devices can exhaust kernel memory over time, degrading system stability and potentially leading to denial of service on long-running hosts.
Affected Products
- Linux Kernel — NVMe subsystem (drivers/nvme)
- Distributions shipping affected upstream kernel versions prior to the referenced stable commits
- Systems using NVMe devices with metadata/integrity (PI) features
Discovery Timeline
- 2026-07-19 - CVE-2026-64072 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64072
Vulnerability Analysis
The vulnerability resides in the NVMe driver code path that maps user data and metadata to a block I/O request. When the driver attempts to perform integrity mapping and that operation fails, the cleanup logic references a local bio variable to release the allocated bio structure. However, this local variable is always NULL at the point of failure, so the actual bio associated with the request is never freed. Each failed mapping leaks one bio allocation from the kernel slab. Under sustained failure conditions the accumulated leak becomes observable as memory pressure and eventual resource exhaustion.
Root Cause
The root cause is an incorrect pointer reference during error handling in the NVMe I/O submission path. The code path assumed the local bio pointer would hold the allocated structure, but the allocation pattern places the bio on the request instead. The fix, as described in the upstream commit message, is to retrieve the bio directly from the request during the failure cleanup so it can be properly released. This class of defect maps to a Memory Leak weakness.
Attack Vector
Exploitation requires the ability to trigger repeated integrity mapping failures against an NVMe device with metadata/PI support enabled. This is generally reachable only by local privileged workloads or by workloads that can issue I/O producing malformed metadata payloads. The vulnerability does not provide code execution or information disclosure. The primary consequence is resource exhaustion leading to degraded availability. No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
The vulnerability manifests inside the NVMe request submission function during integrity mapping error handling. See the referenced upstream kernel commits for the exact code diff and affected functions.
Detection Methods for CVE-2026-64072
Indicators of Compromise
- Steady, unexplained growth in bio slab allocations visible in /proc/slabinfo on hosts with NVMe devices
- Repeated NVMe integrity mapping error messages in dmesg correlated with rising kernel memory usage
- Long-running NVMe workloads showing progressive MemAvailable decline without corresponding userspace attribution
Detection Strategies
- Compare running kernel version and NVMe module build against the upstream stable commits 2279cd9c61a3, 51ec7fc4e10c, and fea4b46f84c5 to identify unpatched hosts.
- Monitor kernel logs for NVMe integrity mapping failures and correlate their frequency with slab growth trends.
- Baseline bio and bio_integrity_payload slab caches on healthy hosts and alert on sustained deviation.
Monitoring Recommendations
- Enable kernel memory telemetry collection (slabtop, /proc/meminfo, /proc/slabinfo) at regular intervals on NVMe-heavy hosts.
- Ingest dmesg and journald kernel facility logs into a centralized data lake for anomaly correlation.
- Track NVMe I/O error counters exposed under /sys/block/nvme*/ for spikes tied to metadata operations.
How to Mitigate CVE-2026-64072
Immediate Actions Required
- Inventory Linux hosts using NVMe devices, prioritizing those with integrity/PI features enabled.
- Apply vendor kernel updates that include the upstream fix commits referenced in the NVD entry.
- Where patching is not immediately possible, monitor for kernel memory growth and schedule controlled reboots to reclaim leaked memory.
Patch Information
The fix is available in the upstream Linux stable tree via commits 2279cd9c61a3, 51ec7fc4e10c, and fea4b46f84c5. Distribution vendors typically backport these commits into their supported kernel packages. Verify the fix is present by reviewing the changelog of the installed kernel package or by inspecting the NVMe subsystem source.
Workarounds
- Disable NVMe metadata/integrity features on affected devices if operationally acceptable until patched kernels are deployed.
- Restrict local access to systems exposing NVMe devices to reduce the surface for triggering integrity mapping failures.
- Schedule periodic reboots on unpatched long-running hosts to reset accumulated kernel memory usage.
# Verify installed kernel version and check for the fix
uname -r
# On Debian/Ubuntu
apt changelog linux-image-$(uname -r) | grep -i "nvme: fix bio leak"
# On RHEL/CentOS
rpm -q --changelog kernel | grep -i "nvme: fix bio leak"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
