Junglewise Threat Intelligence

CVE-2026-64510: Linux Kernel use-after-free in ACPI NFIT core cleanup

CVE-2026-64510 · Severity: info · CVSS 5.5 · Published 2026-07-25

Executive brief

A vulnerability in the Linux kernel's handling of NVDIMM (Non-Volatile Dual In-line Memory Module) devices could allow a local user to cause a system crash. The issue occurs when the system fails to properly clean up memory after a hardware initialization error, leading to a 'use-after-free' condition during subsequent system events like hardware error reporting. This primarily impacts system availability and could lead to unexpected reboots or service outages in environments using persistent memory.

Technical details

A use-after-free vulnerability exists in drivers/acpi/nfit/core.c in the Linux kernel. When acpi_nfit_init() fails after an acpi_desc object has been added to the global acpi_descs list, the object is not removed from the list because the shutdown action is not registered. This leaves a dangling pointer in the list. A subsequent ACPI Machine Check Exception (MCE) triggers nfit_handle_mce(), which iterates over the list and accesses the freed memory. Additionally, a race condition exists where acpi_nfit_update_notify() might allocate an object that is never properly cleaned up during driver removal. The fix introduces explicit calls to acpi_nfit_shutdown() on failure paths and adds a proper remove callback to the driver.

Affected products

  • Linux Linux Kernel All versions prior to fixed stable releases (e.g., 6.10, 6.6.41, 6.1.100, 5.15.163, 5.10.222, 5.4.280, 4.19.318)

Timeline

  • 2026-06-03: patched: Initial fix authored by Rafael J. Wysocki
  • 2026-07-25: disclosed: CVE published to NVD dataset

References

Related threats