Junglewise Threat Intelligence

CVE-2026-64182: Linux Kernel memory block reference leak in poison accounting

CVE-2026-64182 · Severity: info · CVSS 0 · Published 2026-07-19

Vendors: Linux.

Executive brief

A resource management issue was identified in the Linux kernel's memory management subsystem. The system fails to properly release internal references when tracking hardware memory errors (poisoning). Over time, this could lead to a resource leak that might impact system stability or prevent certain memory management operations from completing correctly.

Technical details

A reference leak exists in the memblk_nr_poison_inc() and memblk_nr_poison_sub() functions in drivers/base/memory.c. These functions call find_memory_block_by_id(), which increments the reference count of the memory block device, but they fail to call put_device() to release that reference after updating the nr_hwpoison counter. This results in a persistent reference leak for each successful lookup. The issue has been resolved by adding the missing put_device() calls in the affected helper functions. Fixes are available in stable kernel updates including 6.6.142, 6.12.92, 6.18.34, and 7.0.11.

Affected products

  • Linux Linux 6.2 to 6.6.141, 6.12.91, 6.18.33, 7.0.10

Timeline

  • 2026-07-19: advisory: NVD publication date
  • 2026-06-01: patched: Fixes merged into various stable kernel branches

References