In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails… (CVE-2026-64510)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented in the Linux kernel to address this issue by improving error cleanup and adding proper shutdown callbacks. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended mitigation. Patch status is not explicitly stated here; check the Linux kernel vendor advisory or source repository for the specific fixed versions and apply updates accordingly.
Description
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdown() devm action is not added for the NFIT device in that case. Next, the acpi_nfit_init() failure causes acpi_nfit_probe() to fail, the acpi_desc object is freed, and a dangling pointer is left behind in the acpi_descs. Any subsequent ACPI Machine Check Exception will trigger nfit_handle_mce() which iterates over acpi_descs and so a use-after-free will occur. Moreover, if acpi_nfit_probe() returns 0 after installing a notify handler for the NFIT device and without allocating the acpi_desc object and setting the NFIT device's driver data pointer, the acpi_desc object will be allocated by acpi_nfit_update_notify() and acpi_nfit_init() will be called to initialize it. Regardless of whether or not acpi_nfit_init() fails in that case, the acpi_nfit_shutdown() devm action is not added for the NFIT device and acpi_desc is never removed from the acpi_descs list. If the acpi_desc object is freed subsequently on driver removal, any subsequent ACPI MCE will lead to a use-after-free like in the previous case. To address the first issue mentioned above, make acpi_nfit_probe() call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and to address the other one, add a remove callback to the driver and make it call acpi_nfit_shutdown(). Also, since it is now possible to pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it may not have been initialized, add checks against NULL for acpi_desc and its nvdimm_bus field to that function and make acpi_nfit_unregister() clear the latter after unregistering the NVDIMM bus.
Impact
The vulnerability can cause use-after-free conditions in the Linux kernel ACPI NFIT subsystem, potentially leading to kernel crashes or undefined behavior when handling ACPI Machine Check Exceptions. This could affect system stability and reliability but no direct exploit or privilege escalation details are provided.
Summary
The vulnerability in the Linux kernel ACPI NFIT core arises from improper cleanup when acpi_nfit_init() fails after adding an acpi_desc object to the acpi_descs list. Without adding the acpi_nfit_shutdown() devm action, the object remains in the list even after being freed, causing a dangling pointer. Subsequent ACPI Machine Check Exceptions invoke nfit_handle_mce(), which iterates over acpi_descs and triggers a use-after-free. Another related issue occurs when acpi_nfit_probe() installs a notify handler but does not allocate or initialize the acpi_desc object properly, leading to similar use-after-free risks upon driver removal. The patch addresses these by calling acpi_nfit_shutdown() on failures, adding a remove callback, and adding NULL checks in shutdown and unregister functions.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64510 (opens in a new tab)
- git.kernel.org/stable/c/38bf27511ef41bffebd157ec3eba41fc89ba59cd (opens in a new tab)
- git.kernel.org/stable/c/3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa (opens in a new tab)
- git.kernel.org/stable/c/6ff054cc02a763914773b026cacb429e5fbf64fa (opens in a new tab)
- git.kernel.org/stable/c/7d69235bdc581a4346e9bcd6a8bea37d3e1abd25 (opens in a new tab)
- git.kernel.org/stable/c/b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4 (opens in a new tab)
- git.kernel.org/stable/c/c127dbd832bd4b9aef8a749d9f491b74042f9b47 (opens in a new tab)
- git.kernel.org/stable/c/df7c92216a1583a76cb0cbf2f21cd68870609b05 (opens in a new tab)
- git.kernel.org/stable/c/ee82078e776ae31266cc70fdf62ac17c3c6f100a (opens in a new tab)