CVE-2026-64019nvme-pci: fix dma mapping leak on data setup error
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing unmap helper because it depends on the tracking descriptor being successfully allocated, so a new one for an in-use iterator is provided. The mappings were also leaking when the driver detects an invalid bio_vec when mapping PRPs, so fix that too.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7ce3c1dd78fca86ea8b9aee370db10c7a8cfc3c2 before fba32257979dda14b0d8ed7402490ae0be44972a; from 7ce3c1dd78fca86ea8b9aee370db10c7a8cfc3c2 before e50db059ec8e63bc50b1cc039e2502cb5ea75a70; 7ce3c1dd78fca86ea8b9aee370db10c7a8cfc3c2 builds before 1bf86336e4b6cf40873fda47a7fe191446864937 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.17 before 7.0.11; 7.1; 7.1; 7.1; 7.1 | NVD |
References
- https://git.kernel.org/stable/c/fba32257979dda14b0d8ed7402490ae0be44972a
- https://git.kernel.org/stable/c/e50db059ec8e63bc50b1cc039e2502cb5ea75a70patch
- https://git.kernel.org/stable/c/1bf86336e4b6cf40873fda47a7fe191446864937patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.