CVE-2026-64013
Received Received - Intake

ACPI Button Notify Handler Leak in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ACPI: button: Fix ACPI GPE handler leak during removal Commit a7e23ec17fee ("ACPI: button: Install notifier for system events as well") changed the ACPI notify handler type for ACPI buttons to ACPI_ALL_NOTIFY, but it forgot to update acpi_button_remove() to reflect that change. This leads to leaking the notify handler past driver removal, which may cause a kernel crash to occur if ACPI notify on the given device is triggered after removing the driver, and causes a subsequent probe of the given device with the same driver to fail. Address this by updating the acpi_remove_notify_handler() call in acpi_button_remove() as appropriate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64013
EUVD
EUVD-2026-45586

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ACPI button driver where a notify handler leak occurs during driver removal. The issue arises because the notify handler type was changed to ACPI_ALL_NOTIFY but the removal function was not updated accordingly. This causes the handler to remain active after the driver is removed, potentially leading to a kernel crash if an ACPI notify event is triggered on the device afterward. It also prevents the device from being successfully reprobed with the same driver.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to ACPI button driver handling. Detection requires checking kernel logs for ACPI-related errors or crashes after driver removal. Use commands like dmesg | grep -i acpi or journalctl -k | grep -i acpi to review kernel messages.

Impact Analysis

If you are using a Linux system with ACPI button devices, this vulnerability could cause system instability. A kernel crash may occur if the affected device receives an ACPI notify event after the driver is removed. Additionally, attempting to reprobe the device with the same driver may fail, disrupting normal operation of input devices like power or sleep buttons.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a kernel-level issue causing handler leaks and potential crashes, which may indirectly impact system stability and data integrity but does not introduce direct compliance risks.

Mitigation Strategies

Apply the kernel patch that addresses this issue by updating the ACPI button driver. Ensure your Linux distribution provides the fixed kernel version. Monitor vendor advisories for updates and reboot systems after applying patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64013. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart