CVE-2026-64510
Received Received - Intake

Memory Leak in Linux Kernel ACPI NFIT Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdown() devm action is not added for the NFIT device in that case. Next, the acpi_nfit_init() failure causes acpi_nfit_probe() to fail, the acpi_desc object is freed, and a dangling pointer is left behind in the acpi_descs. Any subsequent ACPI Machine Check Exception will trigger nfit_handle_mce() which iterates over acpi_descs and so a use-after-free will occur. Moreover, if acpi_nfit_probe() returns 0 after installing a notify handler for the NFIT device and without allocating the acpi_desc object and setting the NFIT device's driver data pointer, the acpi_desc object will be allocated by acpi_nfit_update_notify() and acpi_nfit_init() will be called to initialize it. Regardless of whether or not acpi_nfit_init() fails in that case, the acpi_nfit_shutdown() devm action is not added for the NFIT device and acpi_desc is never removed from the acpi_descs list. If the acpi_desc object is freed subsequently on driver removal, any subsequent ACPI MCE will lead to a use-after-free like in the previous case. To address the first issue mentioned above, make acpi_nfit_probe() call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and to address the other one, add a remove callback to the driver and make it call acpi_nfit_shutdown(). Also, since it is now possible to pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it may not have been initialized, add checks against NULL for acpi_desc and its nvdimm_bus field to that function and make acpi_nfit_unregister() clear the latter after unregistering the NVDIMM bus.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64510
EUVD
EUVD-2026-48854

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's ACPI NFIT driver. It occurs when acpi_nfit_init() fails after adding an object to a list but doesn't properly clean it up. This leaves a dangling pointer that can be accessed later, causing a crash or potential code execution if triggered by an ACPI Machine Check Exception.

Detection Guidance

This vulnerability is specific to the Linux kernel's ACPI NFIT driver and requires kernel-level detection. Check your kernel version with 'uname -a' and look for ACPI-related errors in system logs using 'dmesg | grep -i acpi' or 'journalctl -k | grep -i acpi'. If you suspect exploitation, monitor for ACPI Machine Check Exceptions with 'mcelog --client'.

Impact Analysis

This vulnerability could lead to system instability, crashes, or potential privilege escalation if exploited. It specifically affects systems using NVDIMM (Non-Volatile Dual In-line Memory Module) devices managed by the ACPI NFIT driver. Attackers might trigger it via hardware errors or malicious ACPI events.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-64510. If immediate patching is not possible, disable the NFIT driver by blacklisting the module with 'echo "blacklist nfit" >> /etc/modprobe.d/disable-nfit.conf' and reboot. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64510. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart