CVE-2026-64244

Awaiting Analysis Awaiting Analysis - Queue

Memory altmap Use-After-Free in Linux Kernel

Publication date: 2026-07-24

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem->altmap after successful device registration If __add_memory_block() fails at xa_store() (under memory pressure for example), device_unregister() is called, which eventually triggers memory_block_release() with mem->altmap still set, causing a WARN_ON(mem->altmap). This was triggered by modifying virtio-mem driver. Fix this by delaying the assignment of mem->altmap until after __add_memory_block() has succeeded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-17

Generated

2026-09-03

AI Q&A

2026-07-24

EPSS Evaluated

2026-09-02

NVD

CVE-2026-64244

EUVD

EUVD-2026-48653

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.7 (inc) to 6.12.95 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.37 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.14 (exc)
linux	linux_kernel	From 7.1 (inc) to 7.1.2 (exc)
linux	linux_kernel	From 6.6 (inc) to 6.6.144 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a memory management issue occurs during device registration. If a memory block addition fails due to pressure, a cleanup function triggers a warning because an invalid memory map pointer is still set. The fix delays setting this pointer until after successful registration.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management subsystem and does not have direct network detection methods. It may be detected by checking kernel logs for WARN_ON(mem->altmap) messages after memory operations or device registration failures. Review kernel logs for errors related to memory block registration or virtio-mem driver issues.

Impact Analysis

This vulnerability could cause system instability or crashes under memory pressure conditions. It may lead to kernel warnings or errors during memory operations, potentially disrupting normal system functions.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a memory management issue in the Linux kernel. Compliance impacts would depend on how the affected system is used and whether it processes sensitive data.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this issue. Monitor system logs for memory-related warnings or errors that may indicate exploitation or impact.

Hi! I’m here to help you understand CVE-2026-64244. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70