Linux kernel nvme-pci: use-after-free when Host Memory Buffer setup fails during device probe

Impact

nvme_free_host_mem() frees dev->hmb_sgt but never clears the pointer, so the nvme_probe() error path can free it a second time. The reported crash is a NULL dereference inside iommu_dma_free_noncontiguous() that takes the machine down during probe. Reaching it requires an NVMe device that advertises a Host Memory Buffer and then fails nvme_set_host_mem() with an I/O error - HMB is a DRAM-less SSD feature, and the reporter hit it on a Thunderbolt-attached drive behind a dock, not on enterprise U.2 or E1.S media. On a GPU node the realistic exposure is boot or hot-plug of such a device rather than anything a tenant can drive, but a probe-time crash is an unplanned reboot on a node whose jobs are expensive to drain.

Who can reach it

Local and hardware-adjacent: needs an NVMe device advertising HMB that errors during probe, so boot time or a hot-plugged or link-unstable drive. The record describes no authenticated remote path and no tenant-reachable trigger.

What to do

Take the stable fix (the three linked commits), which sets dev->hmb_sgt to NULL after freeing so the second call takes the safe multi-descriptor path. Kernel change: drain and reboot each node onto a patched kernel. No fixed release version is named in the record - follow your distribution's stable backport. Fleets running only enterprise NVMe that does not advertise HMB are in practice unaffected.

References

Related entries

• Linux kernel adm1266 hwmon: PDIO scan bound confused with PMBus command code, out-of-bounds read and writeCVE-2026-64084 · Linux kernel hwmon pmbus/adm1266 (GPIO/PDIO get_multiple bound)High
• Linux kernel adm1266 hwmon: device-supplied block length overflows the blackbox NVMEM buffer by 191 bytesCVE-2026-64085 · Linux kernel hwmon pmbus/adm1266 (blackbox NVMEM record read)High
• Linux kernel adm1266 hwmon: PMBus block read buffer one byte short, i2c write and PEC compare overrunCVE-2026-64086 · Linux kernel hwmon pmbus/adm1266 (pmbus_block_xfer read buffer)High
• Linux kernel IOMMU core: unbalanced unmap accounting on the map error path with iommu_debug onCVE-2026-64152 · Linux kernel IOMMU core (iommu_map error path, iommu_debug tracking)High
• Linux kernel perf AUX buffer: missing aux_mutex in map_range lets a local user map a freed pageCVE-2026-64300 · Linux kernel perf ring buffer AUX area (map_range / rb_alloc_aux locking)High
• Linux kernel QAT crypto driver: oversized RSA CRT components overflow half-size DMA buffersCVE-2026-64304 · Linux kernel crypto qat driver (RSA CRT key setup, qat_rsa_setkey_crt)High