The Linux kernel vulnerability CVE-2026-64183 concerns the allocation timing of a runtime workqueue used for ACPI Platform Runtime Mechanism (PRM) calls delegated to a kernel thread. Early PRM accesses can occur before the efisubsys_init() function allocates the workqueue, leading to NULL pointer dereferences. Because acpi_init() runs as a subsys_initcall and cannot be deferred due to dependencies, the fix involved moving the workqueue allocation to a postcore initcall. This adjustment ensures EFI runtime calls, including PRM calls, are available to all code executing at the subsys_initcall level, preventing NULL pointer dereferences during early ACPI initialization.

The vulnerability can cause NULL pointer dereferences in the Linux kernel during early ACPI PRM calls, potentially leading to denial of service (kernel crashes). There is no indication of confidentiality or integrity impact. The CVSS score of 5.5 reflects a medium severity with local attack vector, low complexity, low privileges required, no user interaction, and impact limited to availability.

The vulnerability has been resolved by a kernel patch that changes the initialization order of the EFI runtime workqueue. Users should apply the official Linux kernel update that includes commit 5894cf571e14 or later. Since no specific patch links are provided, check the Linux kernel mainline or vendor-specific kernel updates for this fix. No alternative mitigations are indicated.