Description
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix freeing of the HMB descriptor table The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent. In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
87ad72a59a38d1df217cfd95bc222a2edfe5d399 to < ac22240540e0c5230d8c4138e3778420b712716aaffected87ad72a59a38d1df217cfd95bc222a2edfe5d399 to < 452f9ddd12bebc04cef741e8ba3806bf0e1fd015affected87ad72a59a38d1df217cfd95bc222a2edfe5d399 to < 869cf50b9c9d1059f5223f79ef68fc0bc6210095affected87ad72a59a38d1df217cfd95bc222a2edfe5d399 to < fb96d5cfa97a7363245b3dd523f475b04296d87baffected87ad72a59a38d1df217cfd95bc222a2edfe5d399 to < cee3bff51a35cab1c5d842d409a7b11caefe2386affected87ad72a59a38d1df217cfd95bc222a2edfe5d399 to < 6d0f599db73b099aa724a12736369c4d4d92849daffected87ad72a59a38d1df217cfd95bc222a2edfe5d399 to < 582d9ed999b004fb1d415ecbfa86d4d8df455269affected87ad72a59a38d1df217cfd95bc222a2edfe5d399 to < 3c2fb1ca8086eb139b2a551358137525ae8e0d7aaffected
Linux Linux
Default version status: affected
4.13affected0 to < 4.13unaffected5.4.287 to ≤ 5.4.*unaffected5.10.231 to ≤ 5.10.*unaffected5.15.174 to ≤ 5.15.*unaffected6.1.120 to ≤ 6.1.*unaffected6.6.64 to ≤ 6.6.*unaffected6.11.11 to ≤ 6.11.*unaffected6.12.2 to ≤ 6.12.*unaffected6.13 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ac22240540e0c5230d8c4138e3778420b712716a ↗
- https://git.kernel.org/stable/c/452f9ddd12bebc04cef741e8ba3806bf0e1fd015 ↗
- https://git.kernel.org/stable/c/869cf50b9c9d1059f5223f79ef68fc0bc6210095 ↗
- https://git.kernel.org/stable/c/fb96d5cfa97a7363245b3dd523f475b04296d87b ↗
- https://git.kernel.org/stable/c/cee3bff51a35cab1c5d842d409a7b11caefe2386 ↗
- https://git.kernel.org/stable/c/6d0f599db73b099aa724a12736369c4d4d92849d ↗
- https://git.kernel.org/stable/c/582d9ed999b004fb1d415ecbfa86d4d8df455269 ↗
- https://git.kernel.org/stable/c/3c2fb1ca8086eb139b2a551358137525ae8e0d7a ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html ↗