Junglewise Threat Intelligence

CVE-2026-64511: Linux Kernel NULL pointer dereference in ACPI NFIT core

CVE-2026-64511 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's ACPI NFIT driver could allow a system crash under specific hardware conditions. The NFIT driver manages NVDIMM (Non-Volatile Dual In-line Memory Module) resources, and this flaw occurs when the system receives a memory error notification before the driver has finished setting up. If triggered by platform firmware, this results in a NULL pointer dereference, leading to a kernel panic and system instability.

Technical details

A race condition or improper initialization sequence exists in the Linux kernel's ACPI NFIT (NVDIMM Firmware Interface Table) driver. Following a specific commit, the `acpi_nfit_probe()` function installs an ACPI notify handler before verifying the presence of the NFIT table. If the table is missing, the driver returns success without allocating the `acpi_desc` object or setting the driver data pointer. If the platform firmware subsequently triggers an `NFIT_NOTIFY_UC_MEMORY_ERROR` notification, the `acpi_nfit_uc_error_notify()` function attempts to dereference the uninitialized (NULL) driver data pointer. This results in a kernel NULL pointer dereference. The fix adds a check to ensure `acpi_desc` is not NULL before proceeding in the notification handler.

Affected products

  • Linux Linux Kernel 6.6 to 6.6.145, 6.12 to 6.12.96, 6.18 to 6.18.39, 7.1 to 7.1.4

Timeline

  • 2026-06-03: patched: Initial fix authored by Rafael J. Wysocki
  • 2026-07-25: disclosed: CVE published in NVD dataset

References

Related threats