Executive brief
A vulnerability in the Linux kernel's NVMe driver could lead to a memory leak when handling data transfers for NVMe storage devices. This occurs when the system fails to properly release memory mappings during specific error conditions, potentially leading to system instability or resource exhaustion over time. This affects systems using NVMe-over-PCIe storage.
Technical details
A vulnerability in 'drivers/nvme/host/pci.c' in the Linux kernel results in a DMA mapping leak. The issue occurs when the driver fails to allocate tracking descriptors for Physical Region Pages (PRP) or Scatter Gather Lists (SGL) during I/O iteration, or when it encounters an invalid bio_vec. Because the existing unmap helper relied on successfully allocated descriptors, the initial DMA mappings remained active without being freed. The fix introduces 'nvme_unmap_iter' to explicitly unmap the iterator when these allocation failures occur. This is a local resource leak that could lead to kernel memory exhaustion.
Affected products
- Linux Linux Kernel 6.17 to 7.0.11
Timeline
- 2026-05-19: other: Patch authored
- 2026-07-19: disclosed: CVE published