CVE-2026-64071

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix use-after-free in nvme_free_host_mem()

nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous()

but never clears the pointer afterward. This leads to a use-after-free

if nvme_free_host_mem() is called twice in the same error path.

This can happen during nvme_probe() when nvme_setup_host_mem() succeeds

in allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem()

fails with an I/O error:

nvme_setup_host_mem()

nvme_alloc_host_mem_single() -> sets dev->hmb_sgt

nvme_set_host_mem() -> fails with -EIO

nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it

return error

nvme_probe() error path:

nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free

The second call dereferences the freed sgt, causing a NULL pointer

dereference in iommu_dma_free_noncontiguous() when it accesses

sgt->sgl->dma_address (the backing memory has been freed and zeroed).

This is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC

Envoy Express behind a Dell WD22TB4 dock) where the device intermittently

returns I/O errors during HMB setup due to PCIe link instability.

BUG: kernel NULL pointer dereference, address: 0000000000000010

RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80

Call Trace:

<TASK>

dma_free_noncontiguous+0x3b/0x130

nvme_free_host_mem+0x30/0xf0 [nvme]

nvme_probe.cold+0xcc/0x275 [nvme]

local_pci_probe+0x43/0xa0

pci_device_probe+0xeea/0x290

really_probe+0xf9/0x3b0

__driver_probe_device+0x8b/0x170

driver_probe_device+0x24/0xd0

__driver_attach_async_helper+0x6b/0x110

async_run_entry_fn+0x37/0x170

process_one_work+0x1ac/0x3d0

worker_thread+0x1b8/0x360

kthread+0xf7/0x130

ret_from_fork+0x2d8/0x3a0

ret_from_fork_asm+0x1a/0x30

</TASK>

Fix this by setting dev->hmb_sgt to NULL after freeing it, so the

second call takes the multi-descriptor path which safely handles the

already-cleaned-up state.