The Linux kernel nvme-pci driver contained a use-after-free vulnerability (CVE-2026-64071) in the nvme_free_host_mem() function. This function frees the dev->hmb_sgt pointer via dma_free_noncontiguous() but does not nullify the pointer afterward. If nvme_free_host_mem() is called twice in the same error path—such as during nvme_probe() when nvme_setup_host_mem() succeeds but nvme_set_host_mem() fails—the stale pointer is dereferenced, causing a NULL pointer dereference in iommu_dma_free_noncontiguous(). This leads to kernel crashes, reproducible on Thunderbolt-attached NVMe devices experiencing intermittent I/O errors. The vulnerability is fixed by setting dev->hmb_sgt to NULL after freeing it, preventing use-after-free conditions.

This vulnerability can cause kernel NULL pointer dereferences leading to system crashes or denial of service on affected Linux systems using the nvme-pci driver. It affects NVMe devices, particularly those connected via Thunderbolt where intermittent I/O errors occur during host memory setup. There is no indication of remote code execution or privilege escalation from the provided data.

A fix is available that sets the dev->hmb_sgt pointer to NULL after freeing it in nvme_free_host_mem(), preventing use-after-free. Users should apply the official Linux kernel patches that address CVE-2026-64071. Since this is a kernel-level issue, updating to a kernel version containing this fix is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.