CVE-2026-64071 Linux CVE debrief

Who should care

Linux kernel developers and users, particularly those using Thunderbolt-attached NVMe devices, should be aware of this vulnerability. The issue can cause a NULL pointer dereference and potentially lead to system crashes or instability. Affected operators and security teams should prioritize updating the Linux kernel to a version that includes the fix.

Technical summary

The vulnerability is caused by nvme_free_host_mem() freeing dev->hmb_sgt via dma_free_noncontiguous() but not clearing the pointer afterward. This leads to a use-after-free if nvme_free_host_mem() is called twice in the same error path. The issue can be triggered during nvme_probe() when nvme_setup_host_mem() succeeds but nvme_set_host_mem() fails with an I/O error. To fix this, setting dev->hmb_sgt to NULL after freeing it prevents use-after-free. The fix involves updating the Linux kernel to include this change.

Defensive priority

High

Recommended defensive actions

• Update the Linux kernel to a version that includes the fix
• Use a Thunderbolt dock or device that does not cause intermittent I/O errors during HMB setup
• Implement additional error checking and handling in nvme_probe() to prevent double-freeing of dev->hmb_sgt
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was introduced due to a missing NULL assignment to dev->hmb_sgt after freeing it in nvme_free_host_mem(). The fix involves setting dev->hmb_sgt to NULL after freeing it to prevent use-after-free. Evidence of the vulnerability includes the stacktrace showing a NULL pointer dereference in iommu_dma_free_noncontiguous().

Official resources