CVE-2026-64180
Received Received - Intake

Memory Block Reference Leak in Linux Kernel

Vulnerability report for CVE-2026-64180, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/memory_hotplug: fix memory block reference leak on remove Patch series "mm: Fix memory block leaks and locking", v2. This series fixes two memory block device reference leaks and one locking issue around the per-memory_block hwpoison counter. This patch (of 2): remove_memory_blocks_and_altmaps() looks up each memory block with find_memory_block(), which acquires a reference to the memory block device. That reference is never dropped on this path, resulting in a leaked device reference when removing memory blocks and their altmaps. Drop the reference after retrieving mem->altmap and clearing mem->altmap, before removing the memory block device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
EUVD

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the memory block device reference system. When removing memory blocks and their associated altmaps, the function remove_memory_blocks_and_altmaps() uses find_memory_block() to look up each memory block, which acquires a reference to the memory block device. However, this reference is never released, causing a leak of the device reference.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management and does not have direct network detection methods. Detection involves checking for memory block reference leaks in the kernel logs or through system monitoring tools. Look for errors related to memory block removal or hwpoison counter issues in dmesg or journalctl logs.

Impact Analysis

The impact of this vulnerability is primarily on system stability and resource management. A leaked device reference can lead to unnecessary memory consumption, potentially causing performance degradation or system instability over time, especially in systems with frequent memory block additions and removals.

Compliance Impact

This vulnerability involves a memory block reference leak in the Linux kernel during memory removal operations. It does not directly impact data privacy, security controls, or compliance with standards like GDPR or HIPAA, as it pertains to system resource management rather than data handling or protection mechanisms.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the memory block reference leak. Monitor system logs for memory block removal errors and ensure proper memory management practices are followed. Reboot the system after applying patches to ensure changes take effect.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart