Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-64071

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix use-after-free in nvme_free_host_mem() nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous() but never clears the pointer afterward. This leads to a use-after-free if nvme_free_host_mem() is called twice in the same error path. This can happen during nvme_probe() when nvme_setup_host_mem() succeeds in allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem() fails with an I/O error: nv
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:1deea005ce3fe2abd2d80608d3366e64d7a9bf6131f835eb83fa4864d96156d3
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nvme/host/pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:be4bade2f3a7631a8bfaa4776936390077afc4b331cd5304ec1a67006fb53876 · sha256:3bf7e809f089bcc2… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nvme/host/pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9525e3a6fbb1d126a22ab2ee86ddea25af581a7c","status":"affected","version":"63a5c7a4b4c49ad86c362e9f555e6f343804ee1d","versionType":"git"},{"lessThan":"7c89f474005d8377525d2991930b7432ee193a52","status":"affected","version":"63a5c7a4b4c49ad86c362e9f555e6f343804ee1d","versionType":"git"},{"lessThan":"b35a13036755c5803168a7cb93bc66035c3e65b8","status":"affected","version":"63a5c7a4b4c49ad86c362e…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:be4bade2f3a7631a8bfaa4776936390077afc4b331cd5304ec1a67006fb53876 · sha256:3bf7e809f089bcc2… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nvme/host/pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:be4bade2f3a7631a8bfaa4776936390077afc4b331cd5304ec1a67006fb53876 · sha256:3bf7e809f089bcc2… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nvme/host/pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9525e3a6fbb1d126a22ab2ee86ddea25af581a7c","status":"affected","version":"63a5c7a4b4c49ad86c362e9f555e6f343804ee1d","versionType":"git"},{"lessThan":"7c89f474005d8377525d2991930b7432ee193a52","status":"affected","version":"63a5c7a4b4c49ad86c362e9f555e6f343804ee1d","versionType":"git"},{"lessThan":"b35a13036755c5803168a7cb93bc66035c3e65b8","status":"affected","version":"63a5c7a4b4c49ad86c362e…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:be4bade2f3a7631a8bfaa4776936390077afc4b331cd5304ec1a67006fb53876 · sha256:3bf7e809f089bcc2… · /containers/cna/affected/0

Source references

3 source assertions
{"url":"https://git.kernel.org/stable/c/7c89f474005d8377525d2991930b7432ee193a52"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:be4bade2f3a7631a8bfaa4776936390077afc4b331cd5304ec1a67006fb53876 · sha256:3bf7e809f089bcc2… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/9525e3a6fbb1d126a22ab2ee86ddea25af581a7c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:be4bade2f3a7631a8bfaa4776936390077afc4b331cd5304ec1a67006fb53876 · sha256:3bf7e809f089bcc2… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/b35a13036755c5803168a7cb93bc66035c3e65b8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:be4bade2f3a7631a8bfaa4776936390077afc4b331cd5304ec1a67006fb53876 · sha256:3bf7e809f089bcc2… · /containers/cna/references/2

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer