CVE-2024-56756

What it actually does

Incorrect size calculation for dma_free_coherent when __nvme_alloc_host_mem exits early on allocation failure, causing the HMB descriptor table to be freed with a mismatched size.

Why it matters to the business

Systems using NVMe storage with host memory buffers may experience memory corruption, crashes, or instability; widespread kernel impact increases urgency for patching across Linux deployments.

How an attack unfolds

An attacker with local access triggers repeated memory allocation pressure during NVMe HMB setup to force an early loop exit, then leverages the resulting incorrect dma_free_coherent size for memory corruption primitives leading to privilege escalation or denial of service.

How to fix it

Update to a fixed kernel version that correctly tracks actual descriptor usage before freeing; apply vendor-supplied NVMe driver patches immediately given the kernel's broad ecosystem reach.

How to confirm the fix worked

Confirm the nvme-pci driver no longer passes an overestimated descriptor count to dma_free_coherent by reviewing source or testing allocation-failure paths; verify kernel version contains the upstream fix for HMB table sizing.

Typical attack path

1. Gain local code execution on affected Linux system
2. Induce memory pressure during nvme-pci HMB allocation
3. Force early return from __nvme_alloc_host_mem
4. Trigger dma_free_coherent with wrong descriptor count
5. Exploit resulting memory corruption for escalation

How to detect it

Review kernel logs and dmesg for nvme HMB allocation or dma_free_coherent warnings; inspect crash dumps showing mismatched descriptor table sizes during nvme-pci initialization.

What your security team should do

• Prioritize kernel updates on all NVMe-equipped Linux hosts
• Monitor for related memory corruption indicators in dmesg and kernel logs
• Test HMB-enabled NVMe devices under memory-constrained conditions post-update