Linux kernel nvme-pci: dma_vec allocations leak on every peer-to-peer I/O completion

Impact

P2P memory is never unmapped, so the driver did not need to track it, but the dma_vec allocation was still made and never freed on completion. Each P2PDMA NVMe I/O therefore leaks kernel memory. This path is exactly what GPUDirect Storage style setups exercise - NVMe transfers staged directly into device memory - so a node doing sustained dataset streaming leaks continuously rather than occasionally, ending in memory exhaustion and an unusable node. The record gives no evidence of memory disclosure or code execution; the realistic outcome is availability loss on the node.

Who can reach it

Local workload on the node that drives NVMe I/O over peer-to-peer DMA. No special privilege beyond the ability to run storage I/O on a node configured for P2PDMA; nodes without P2PDMA in use are not exposed.

What to do

Pick up the stable kernel carrying the nvme-pci dma_vec fix and reboot each affected node. There is no runtime mitigation other than disabling the P2PDMA path, which on a GPUDirect Storage fleet means giving up the performance the hardware was bought for. Reclaiming the already-leaked memory requires a reboot regardless.

References

Related entries

• Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot): Slot 0 of the client's ISM device array isCVE-2026-64048 · Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot)High
• Linux kernel pcrypt: padata fallback leaves the parallel completion callback on the child requestCVE-2026-64312 · Linux kernel crypto pcrypt (padata -EBUSY fallback path)High
• Linux kernel RT scheduler: RT_PUSH_IPI can livelock a busy many-core node under softirq loadCVE-2026-64374 · Linux kernel RT scheduler (RT_PUSH_IPI pull logic on non-PREEMPT_RT kernels)High
• Linux kernel libceph: a monmap advertising zero monitors hits a BUG_ON and takes down the client nodeCVE-2026-68155 · Linux kernel libceph (ceph_monmap_decode, zero-monitor monmap)High
• Linux kernel libceph: NULL dereference in CRUSH locality lookup when a parent bucket's type name is missingCVE-2026-68157 · Linux kernel libceph (get_immediate_parent CRUSH type name lookup)High
• Linux kernel (net/tls): A remote peer sends a zero-length TLS 1.3 application_data record - which the RFC explicitlyCVE-2026-72330 · Linux kernel (net/tls)High