Executive brief
A memory leak was identified in the Linux kernel's NVMe driver when handling peer-to-peer (P2P) memory transfers. This issue occurs in the component responsible for managing high-speed storage devices. Over time, this leak could consume system memory resources, potentially leading to degraded performance or system instability.
Technical details
A memory leak exists in the Linux kernel's NVMe-PCI driver (drivers/nvme/host/pci.c). The vulnerability stems from the `nvme_pci_prp_save_mapping` function incorrectly tracking and failing to release `dma_vec` allocations for Peer-to-Peer (P2P) memory transactions. Because P2P memory does not require DMA unmapping, the driver was unnecessarily allocating tracking structures that were never freed during request completion. An attacker with local access could potentially trigger numerous P2P memory operations to exhaust kernel memory. The issue has been resolved by adding a check for the `IOD_DATA_P2P` flag to skip unnecessary mapping tracking.
Affected products
- Linux Linux Kernel 6.17 to 7.0.11
Timeline
- 2026-05-19: other: Patch authored
- 2026-07-19: disclosed: CVE published