Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix use-after-free in nvme_free_host_mem() nvme_free_host_mem() frees… (CVE-2026-64071)

The Linux kernel nvme-pci driver contained a use-after-free vulnerability in the nvme_free_host_mem() function. This function frees the dev->hmb_sgt pointer via dma_free_noncontiguous() but does not nullify the pointer afterward. If nvme_free_host_mem() is called twice in the same error path, such as during nvme_probe() when nvme_setup_host_mem() succeeds but nvme_set_host_mem() fails, the stale pointer is dereferenced, causing a use-after-free and a NULL pointer dereference in iommu_dma_free_noncontiguous(). This flaw was resolved in kernel versions starting from 7.0.0-28.28.1 and other patched builds. The vulnerability has a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to use-after-free conditions causing NULL pointer dereferences, potentially resulting in system crashes or privilege escalation due to memory corruption. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

A patch is available and should be applied by updating the Linux kernel to versions 7.0.0-28.28.1 or later, or the corresponding fixed builds listed in the advisory. After applying the update, a system reboot is required. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. Follow the vendor's update instructions carefully to ensure full remediation.