In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails… (CVE-2026-64510)
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdown() devm action is not added for the NFIT device in that case. Next, the acpi_nfit_init() failure causes acpi_nfit_probe() to fail, the acpi_desc object is freed, and a dangling pointer is left behind in the acpi_descs. Any subsequent ACPI Machine Check Exception will trigger nfit_handle_mce() which iterates over acpi_descs and so a use-after-free will occur. Moreover, if acpi_nfit_probe() returns 0 after installing a notify handler for the NFIT device and without allocating the acpi_desc object and setting the NFIT device's driver data pointer, the acpi_desc object will be allocated by acpi_nfit_update_notify() and acpi_nfit_init() will be called to initialize it. Regardless of whether or not acpi_nfit_init() fails in that case, the acpi_nfit_shutdown() devm action is not added for the NFIT device and acpi_desc is never removed from the acpi_descs list. If the acpi_desc object is freed subsequently on driver removal, any subsequent ACPI MCE will lead to a use-after-free like in the previous case. To address the first issue mentioned above, make acpi_nfit_probe() call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and to address the other one, add a remove callback to the driver and make it call acpi_nfit_shutdown(). Also, since it is now possible to pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it may not have been initialized, add checks against NULL for acpi_desc and its nvdimm_bus field to that function and make acpi_nfit_unregister() clear the latter after unregistering the NVDIMM bus.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel ACPI NFIT core arises from improper cleanup when acpi_nfit_init() fails after adding an acpi_desc object to the acpi_descs list. Without adding the acpi_nfit_shutdown() devm action, the object remains in the list even after being freed, causing a dangling pointer. Subsequent ACPI Machine Check Exceptions invoke nfit_handle_mce(), which iterates over acpi_descs and triggers a use-after-free. Another related issue occurs when acpi_nfit_probe() installs a notify handler but does not allocate or initialize the acpi_desc object properly, leading to similar use-after-free risks upon driver removal. The patch addresses these by calling acpi_nfit_shutdown() on failures, adding a remove callback, and adding NULL checks in shutdown and unregister functions.
Potential Impact
The vulnerability can cause use-after-free conditions in the Linux kernel ACPI NFIT subsystem, potentially leading to kernel crashes or undefined behavior when handling ACPI Machine Check Exceptions. This could affect system stability and reliability but no direct exploit or privilege escalation details are provided.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by improving error cleanup and adding proper shutdown callbacks. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended mitigation. Patch status is not explicitly stated here; check the Linux kernel vendor advisory or source repository for the specific fixed versions and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails… (CVE-2026-64510)
Description
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdown() devm action is not added for the NFIT device in that case. Next, the acpi_nfit_init() failure causes acpi_nfit_probe() to fail, the acpi_desc object is freed, and a dangling pointer is left behind in the acpi_descs. Any subsequent ACPI Machine Check Exception will trigger nfit_handle_mce() which iterates over acpi_descs and so a use-after-free will occur. Moreover, if acpi_nfit_probe() returns 0 after installing a notify handler for the NFIT device and without allocating the acpi_desc object and setting the NFIT device's driver data pointer, the acpi_desc object will be allocated by acpi_nfit_update_notify() and acpi_nfit_init() will be called to initialize it. Regardless of whether or not acpi_nfit_init() fails in that case, the acpi_nfit_shutdown() devm action is not added for the NFIT device and acpi_desc is never removed from the acpi_descs list. If the acpi_desc object is freed subsequently on driver removal, any subsequent ACPI MCE will lead to a use-after-free like in the previous case. To address the first issue mentioned above, make acpi_nfit_probe() call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and to address the other one, add a remove callback to the driver and make it call acpi_nfit_shutdown(). Also, since it is now possible to pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it may not have been initialized, add checks against NULL for acpi_desc and its nvdimm_bus field to that function and make acpi_nfit_unregister() clear the latter after unregistering the NVDIMM bus.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel ACPI NFIT core arises from improper cleanup when acpi_nfit_init() fails after adding an acpi_desc object to the acpi_descs list. Without adding the acpi_nfit_shutdown() devm action, the object remains in the list even after being freed, causing a dangling pointer. Subsequent ACPI Machine Check Exceptions invoke nfit_handle_mce(), which iterates over acpi_descs and triggers a use-after-free. Another related issue occurs when acpi_nfit_probe() installs a notify handler but does not allocate or initialize the acpi_desc object properly, leading to similar use-after-free risks upon driver removal. The patch addresses these by calling acpi_nfit_shutdown() on failures, adding a remove callback, and adding NULL checks in shutdown and unregister functions.
Potential Impact
The vulnerability can cause use-after-free conditions in the Linux kernel ACPI NFIT subsystem, potentially leading to kernel crashes or undefined behavior when handling ACPI Machine Check Exceptions. This could affect system stability and reliability but no direct exploit or privilege escalation details are provided.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by improving error cleanup and adding proper shutdown callbacks. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended mitigation. Patch status is not explicitly stated here; check the Linux kernel vendor advisory or source repository for the specific fixed versions and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7m99-cfrm-m9cq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64510"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542069c2644c7f80820a2
Added to database: 07/25/2026, 23:08:54 UTC
Last enriched: 07/25/2026, 23:14:38 UTC
Last updated: 09/07/2026, 22:52:14 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.