Linux Kernel CVE-2026-64071

Exploitation requires: (1) a kernel build with NVMe PCI HMB support compiled in (nvme-pci module loaded), (2) a PCIe/Thunderbolt-attached NVMe device that supports HMB and is successfully allocated but then returns an I/O error on the nvme_set_host_mem() admin command, and (3) local or physical access to trigger or coincide with the device probe sequence. The bug fires automatically when these conditions are met - no additional attacker input is needed once the error path is reached. The condition is NOT remotely triggerable over the network; it requires physical hardware presence or a pre-installed device with intermittent link stability. PR:L in the vendor CVSS implies low-privilege access, consistent with the NVMe probe occurring as part of kernel device initialization accessible when a user connects a Thunderbolt device. Systems without NVMe HMB-capable devices or without Thunderbolt connectivity are not affected.

The provided CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is plausible for a kernel use-after-free but likely overstates the confidentiality and integrity impact for this specific code path. The deterministic outcome described in the bug report is a kernel panic (NULL pointer dereference after freed memory is zeroed by DMA teardown), making A:H the primary confirmed impact. C:H and I:H are the theoretical upper bound for CWE-416 class flaws but are not demonstrated for this specific instance. EPSS of 0.17% (7th percentile) correctly reflects that no weaponized or publicly available exploit exists. This bug is not in CISA KEV. Real-world triggering requires a hardware event (NVMe device returning I/O error during HMB setup at probe time), making opportunistic remote exploitation impossible - this is a local/physical-access or hardware-fault-induced kernel stability issue, not a remote attack primitive. Priority is patch application on Linux systems with NVMe devices, but the absence of a public exploit and low EPSS score indicate low urgency compared to remotely exploitable kernel flaws.

A system with a Thunderbolt-attached NVMe device experiences PCIe link instability (e.g., through a flaky dock connection such as the OWC Envoy Express behind a Dell WD22TB4), causing the device to return an I/O error during kernel HMB setup at probe time. The double-free path is automatically triggered by the kernel error handling, crashing the system with a NULL pointer dereference in iommu_dma_free_noncontiguous() - no user-space attacker input is required. A local attacker with physical Thunderbolt access could potentially induce this condition by briefly interrupting the device connection during NVMe initialization, forcing a kernel panic.