CVE-2024-56756

nvme-pci: fix freeing of the HMB descriptor table

State: Published
Severity: 5.5 Medium
Published: Dec 29, 2024
Updated: May 11, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix freeing of the HMB descriptor table

The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent.

In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before ac22240540e0c5230d8c4138e3778420b712716aAffected 87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before 452f9ddd12bebc04cef741e8ba3806bf0e1fd015Affected 87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before 869cf50b9c9d1059f5223f79ef68fc0bc6210095Affected 87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before fb96d5cfa97a7363245b3dd523f475b04296d87bAffected 87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before cee3bff51a35cab1c5d842d409a7b11caefe2386Affected 87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before 6d0f599db73b099aa724a12736369c4d4d92849dAffected 87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before 582d9ed999b004fb1d415ecbfa86d4d8df455269Affected 87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before 3c2fb1ca8086eb139b2a551358137525ae8e0d7aAffected
LinuxLinux	4.13Affected before 4.13Not affected 5.4.287 through 5.4.Not affected 5.10.231 through 5.10.Not affected 5.15.174 through 5.15.Not affected 6.1.120 through 6.1.Not affected 6.6.64 through 6.6.Not affected 6.11.11 through 6.11.Not affected 6.12.2 through 6.12.*Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before ac22240540e0c5230d8c4138e3778420b712716aAffected
87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before 452f9ddd12bebc04cef741e8ba3806bf0e1fd015Affected
87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before 869cf50b9c9d1059f5223f79ef68fc0bc6210095Affected
87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before fb96d5cfa97a7363245b3dd523f475b04296d87bAffected
87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before cee3bff51a35cab1c5d842d409a7b11caefe2386Affected
87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before 6d0f599db73b099aa724a12736369c4d4d92849dAffected
87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before 582d9ed999b004fb1d415ecbfa86d4d8df455269Affected
87ad72a59a38d1df217cfd95bc222a2edfe5d399 to before 3c2fb1ca8086eb139b2a551358137525ae8e0d7aAffected

LinuxLinux

4.13Affected
before 4.13Not affected
5.4.287 through 5.4.*Not affected
5.10.231 through 5.10.*Not affected
5.15.174 through 5.15.*Not affected
6.1.120 through 6.1.*Not affected
6.6.64 through 6.6.*Not affected
6.11.11 through 6.11.*Not affected
6.12.2 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.