Linux kernel nvme-pci: DMA mappings leak when PRP/SGL descriptor allocation fails

CVSS 5.5CVE-2026-64019Kernel, userspace & hypervisorcurated

Impact

The NVMe PCI driver leaks the initial DMA mapping when it fails to allocate the PRP or SGL tracking descriptor during request setup, and also leaks mappings when it rejects an invalid bio_vec while building PRPs. Leaked IOMMU/DMA mappings accumulate and can exhaust mapping resources, degrading or stalling local NVMe I/O on the node. On a GPU node this hits the local scratch and dataset cache that training jobs stream from, and recovery means a reboot because the leak is not reclaimable at runtime. Reaching it requires the allocation-failure path, so it is a memory-pressure or local-abuse condition rather than a remote one.

Who can reach it

Local user with the ability to submit I/O to an NVMe device; the trigger is descriptor allocation failure, so it needs memory pressure rather than special privilege. No remote path.

What to do

Pick up the stable kernel commits (1bf86336e4b6, e50db059ec8e) via your distribution kernel update, then drain and reboot each affected node. There is no runtime mitigation for a driver fix of this kind.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-64019 https://git.kernel.org/stable/c/1bf86336e4b6cf40873fda47a7fe191446864937 https://git.kernel.org/stable/c/e50db059ec8e63bc50b1cc039e2502cb5ea75a70

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.