CVE-2026-64019: nvme-pci: fix dma mapping leak on data setup error

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix dma mapping leak on data setup error

We're leaking the initial DMA mapping during iteration if we fail to
allocate the tracking descriptor for both PRP and SGL. Unmap the
iterator directly; we can't use the existing unmap helper because it
depends on the tracking descriptor being successfully allocated, so a
new one for an in-use iterator is provided.

The mappings were also leaking when the driver detects an invalid
bio_vec when mapping PRPs, so fix that too.

The Linux kernel CVE team has assigned CVE-2026-64019 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.17 with commit 7ce3c1dd78fca86ea8b9aee370db10c7a8cfc3c2 and fixed in 7.0.11 with commit e50db059ec8e63bc50b1cc039e2502cb5ea75a70
	Issue introduced in 6.17 with commit 7ce3c1dd78fca86ea8b9aee370db10c7a8cfc3c2 and fixed in 7.1 with commit 1bf86336e4b6cf40873fda47a7fe191446864937

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64019
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/nvme/host/pci.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e50db059ec8e63bc50b1cc039e2502cb5ea75a70
	https://git.kernel.org/stable/c/1bf86336e4b6cf40873fda47a7fe191446864937