CVE-2026-23174

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: handle changing device dma map requirements The initial state of dma_needs_unmap may be false, but change to true while mapping the data iterator. Enabling swiotlb is one such case that can change the result. The nvme driver needs to save the mapped dma vectors to be unmapped later, so allocate as needed during iteration rather than assume it was always allocated at the beginning. This fixes a NULL dereference from accessing an uninitialized dma_vecs when the device dma unmapping requirements change mid-iteration.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/071be3b0b6575d45be9df9c5b612f5882bfc5e88
https://git.kernel.org/stable/c/f3ed399e9aa6f36e92d2d0fe88b387915e9705fe

Configurations

No configuration.

History

No history.

Information

Published : 2026-02-14 17:15

Updated : 2026-06-17 10:21

NVD link : CVE-2026-23174

Mitre link : CVE-2026-23174

CVE.ORG link : CVE-2026-23174

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-23174", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b8b7570a7ec872f2a27b775c4f8710ca8a357adf", "lessThan": "f3ed399e9aa6f36e92d2d0fe88b387915e9705fe", "versionType": "git"}, {"status": "affected", "version": "b8b7570a7ec872f2a27b775c4f8710ca8a357adf", "lessThan": "071be3b0b6575d45be9df9c5b612f5882bfc5e88", "versionType": "git"}], "programFiles": ["drivers/nvme/host/pci.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"status": "unaffected", "version": "0", "lessThan": "6.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.10", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/nvme/host/pci.c"], "defaultStatus": "affected"}]}], "published": "2026-02-14T17:15:55.103", "references": [{"url": "https://git.kernel.org/stable/c/071be3b0b6575d45be9df9c5b612f5882bfc5e88", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f3ed399e9aa6f36e92d2d0fe88b387915e9705fe", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: handle changing device dma map requirements\n\nThe initial state of dma_needs_unmap may be false, but change to true\nwhile mapping the data iterator. Enabling swiotlb is one such case that\ncan change the result. The nvme driver needs to save the mapped dma\nvectors to be unmapped later, so allocate as needed during iteration\nrather than assume it was always allocated at the beginning. This fixes\na NULL dereference from accessing an uninitialized dma_vecs when the\ndevice dma unmapping requirements change mid-iteration."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnvme-pci: manejar los requisitos cambiantes del mapa dma del dispositivo\n\nEl estado inicial de dma_needs_unmap puede ser falso, pero cambiar a verdadero mientras se mapea el iterador de datos. Habilitar swiotlb es uno de esos casos que puede cambiar el resultado. El controlador nvme necesita guardar los vectores dma mapeados para ser desmapeados m\u00e1s tarde, as\u00ed que asignar seg\u00fan sea necesario durante la iteraci\u00f3n en lugar de asumir que siempre fue asignado al principio. Esto corrige una desreferencia NULL al acceder a un dma_vecs no inicializado cuando los requisitos de desmapeo dma del dispositivo cambian a mitad de la iteraci\u00f3n."}], "lastModified": "2026-06-17T10:21:02.370", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}