In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA… (CVE-2026-64019)
A vulnerability in the Linux kernel's nvme-pci driver caused a DMA mapping leak during data setup errors. The issue occurs when the driver fails to allocate a tracking descriptor for PRP and SGL mappings, leading to unreleased DMA mappings. Additionally, mappings leaked when invalid bio_vec structures were detected during PRP mapping. This vulnerability has been resolved by introducing a new unmap method that handles in-use iterators without relying on the tracking descriptor.
AI Analysis
Technical Summary
CVE-2026-64019 addresses a DMA mapping leak in the Linux kernel's nvme-pci driver. The leak happens when the driver fails to allocate tracking descriptors for PRP and SGL during data setup errors, causing the initial DMA mappings to remain unreleased. The existing unmap helper could not be used because it depends on successful allocation of the tracking descriptor. The fix introduces a new unmap method for in-use iterators to properly release these mappings. The vulnerability also involved leaks when invalid bio_vec structures were detected during PRP mapping, which has been corrected.
Potential Impact
The vulnerability results in a resource leak of DMA mappings in the Linux kernel nvme-pci driver during certain error conditions. While this does not directly lead to code execution or privilege escalation, it can cause resource exhaustion or degraded system performance due to unreleased DMA mappings.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to resolve the DMA mapping leak. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories for the exact fixed versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA… (CVE-2026-64019)
Description
A vulnerability in the Linux kernel's nvme-pci driver caused a DMA mapping leak during data setup errors. The issue occurs when the driver fails to allocate a tracking descriptor for PRP and SGL mappings, leading to unreleased DMA mappings. Additionally, mappings leaked when invalid bio_vec structures were detected during PRP mapping. This vulnerability has been resolved by introducing a new unmap method that handles in-use iterators without relying on the tracking descriptor.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-64019 addresses a DMA mapping leak in the Linux kernel's nvme-pci driver. The leak happens when the driver fails to allocate tracking descriptors for PRP and SGL during data setup errors, causing the initial DMA mappings to remain unreleased. The existing unmap helper could not be used because it depends on successful allocation of the tracking descriptor. The fix introduces a new unmap method for in-use iterators to properly release these mappings. The vulnerability also involved leaks when invalid bio_vec structures were detected during PRP mapping, which has been corrected.
Potential Impact
The vulnerability results in a resource leak of DMA mappings in the Linux kernel nvme-pci driver during certain error conditions. While this does not directly lead to code execution or privilege escalation, it can cause resource exhaustion or degraded system performance due to unreleased DMA mappings.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to resolve the DMA mapping leak. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v3pf-3p93-7xxv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64019"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912d547
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 19:58:24 UTC
Last updated: 07/20/2026, 17:33:59 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.