Linux Kernel EUVD-2026-32346

The vulnerability resides in the Linux kernel's PCI Peer-to-Peer DMA (P2PDMA) subsystem, within the p2pmem_alloc_mmap() function in drivers/pci/p2pdma.c. P2PDMA enables direct memory transfers between PCI devices without CPU involvement, using a gen_pool allocator and pgmap (page map) structures managed with per-CPU reference counting (percpu_ref). When gen_pool_alloc_owner() succeeds it increments the pgmap per-CPU ref. If the subsequent vm_insert_page() call fails - for example due to virtual address space exhaustion - the function returns the error without calling percpu_ref_put() to release the previously acquired ref. This off-by-one reference leak prevents the count from ever reaching zero, so memunmap_pages(), invoked during PCI device removal or hotplug, spins indefinitely waiting for the ref to drop. The root cause is a missing cleanup step on an error path, analogous to CWE-772 (Missing Release of Resource after Effective Lifetime). The CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* covers all Linux kernel versions within the affected commit range. Note: the input tag 'Information Disclosure' conflicts with the CVSS vector (C:N) and the description - no confidentiality impact is present.