CVE-2026-64071

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the nvme free host mem() function. The function frees dev->hmb sgt using dma free noncontiguous() but fails to clear the pointer. If nvme free host mem() is called twice within the same error path—specifically during nvme probe() when nvme setup host mem() succeeds but nvme set host mem() fails with an I/O error—the second call dereferences the stale dev->hmb sgt pointer. This results in a NULL pointer dereference in iommu dma free noncontiguous() when accessing sgt->sgl->dma address. This behavior has been observed on Thunderbolt-attached NVMe devices experiencing PCIe link instability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.