Executive brief
A vulnerability in the Linux kernel's ACPI NFIT driver could allow a system crash under specific hardware conditions. The NFIT driver manages NVDIMM (Non-Volatile Dual In-line Memory Module) resources, and this flaw occurs when the system receives a memory error notification before the driver has finished setting up. If triggered by platform firmware, this results in a NULL pointer dereference, leading to a kernel panic and system instability.
Technical details
A race condition or improper initialization sequence exists in the Linux kernel's ACPI NFIT (NVDIMM Firmware Interface Table) driver. Following a specific commit, the `acpi_nfit_probe()` function installs an ACPI notify handler before verifying the presence of the NFIT table. If the table is missing, the driver returns success without allocating the `acpi_desc` object or setting the driver data pointer. If the platform firmware subsequently triggers an `NFIT_NOTIFY_UC_MEMORY_ERROR` notification, the `acpi_nfit_uc_error_notify()` function attempts to dereference the uninitialized (NULL) driver data pointer. This results in a kernel NULL pointer dereference. The fix adds a check to ensure `acpi_desc` is not NULL before proceeding in the notification handler.
Affected products
- Linux Linux Kernel 6.6 to 6.6.145, 6.12 to 6.12.96, 6.18 to 6.18.39, 7.1 to 7.1.4
Timeline
- 2026-06-03: patched: Initial fix authored by Rafael J. Wysocki
- 2026-07-25: disclosed: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/027e128abb82788189d6d45b68e3e8e7329b67be
- https://git.kernel.org/stable/c/3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6
- https://git.kernel.org/stable/c/452945662fd8e9862a2d2043239c7ee1815d1ac4
- https://git.kernel.org/stable/c/873576e585da5d0fc5debbab74eed565c0acea99
- https://git.kernel.org/stable/c/a44343fe230aa48c74ef09830f3c5c90848b257e