CVE-2026-64013: Linux Kernel ACPI Button DoS Vulnerability

CVE-2026-64013 Overview

CVE-2026-64013 is a Linux kernel vulnerability in the Advanced Configuration and Power Interface (ACPI) button driver. The flaw causes a General Purpose Event (GPE) notify handler leak during driver removal. Commit a7e23ec17fee ("ACPI: button: Install notifier for system events as well") changed the notify handler type to ACPI_ALL_NOTIFY but did not update acpi_button_remove() accordingly. The mismatch leaves the handler registered after the driver unloads.

Critical Impact
An ACPI notify event delivered after driver removal can trigger a kernel crash, and subsequent driver re-probing of the affected device fails.

Affected Products

Linux kernel versions containing commit a7e23ec17fee prior to the fix
Systems using the ACPI button driver for power, sleep, and lid events
Distributions shipping the affected upstream kernel revisions

Discovery Timeline

2026-07-19 - CVE-2026-64013 published to the National Vulnerability Database
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64013

Vulnerability Analysis

The ACPI button driver handles notifications for power buttons, sleep buttons, and lid switches. The offending commit switched the notify handler installation from device-specific events to ACPI_ALL_NOTIFY, which covers both device and system notify types. The corresponding removal path in acpi_button_remove() continued to call acpi_remove_notify_handler() with the previous handler type. ACPI treats the remove request as targeting a different handler and does not detach the registered callback.

The stale handler remains bound to the ACPI namespace object after the driver module unloads. When firmware raises a notify event on the device, the ACPI core dispatches execution to memory that no longer belongs to the driver. This produces a kernel crash on function pointer invocation. A subsequent module reload fails at probe time because the ACPI subsystem rejects the duplicate handler installation.

Root Cause

The root cause is a symmetry defect between handler installation and removal. acpi_install_notify_handler() was updated to use ACPI_ALL_NOTIFY, while acpi_remove_notify_handler() retained the prior notify type constant. ACPICA requires matching type arguments to locate and detach a registered handler, so the removal call silently fails to unregister the callback.

Attack Vector

Exploitation requires local access with the ability to unload and reload the ACPI button driver, followed by a firmware-generated notify event on the button device. The attack surface is limited to kernel stability. The condition manifests as a kernel Oops or panic rather than a remote code execution primitive. The vulnerability is classified as a kernel driver defect [CWE-noinfo] with no known in-the-wild exploitation and no CISA KEV listing.

The vulnerability manifests in the driver teardown path. See the upstream kernel commits 614cb8c and fe80251 for the technical fix.

Detection Methods for CVE-2026-64013

Indicators of Compromise

Kernel Oops or panic messages referencing the ACPI notify dispatch path shortly after removing the button driver module
dmesg entries showing failed probe of the ACPI button device after a module reload
Unexpected system instability following power, sleep, or lid button events on hosts that recently rebound ACPI drivers

Detection Strategies

Inventory running kernel versions and compare against distribution advisories referencing commits 614cb8c26c5aa53196ee9b211b76ee618b147d32 and fe80251152fed5b185f795ef2cd9f7fe9c3162e0
Audit kernel crash dumps for stack traces containing acpi_ev_notify_dispatch or acpi_button symbols
Monitor systemd journal for repeated ACPI button probe failures after module operations

Monitoring Recommendations

Forward kernel.crash and kernel.emerg syslog facilities to a centralized log platform for correlation
Track kernel module load and unload events using auditd rules on init_module and delete_module syscalls
Alert on kernel panics involving ACPI subsystems across fleets of laptops and servers with ACPI button hardware

How to Mitigate CVE-2026-64013

Immediate Actions Required

Apply vendor-provided kernel updates that include the upstream fix from commits 614cb8c and fe80251
Reboot hosts after patching to ensure the corrected driver replaces the in-memory version
Restrict privileged access needed to load or unload kernel modules on production systems

Patch Information

The fix updates the acpi_remove_notify_handler() call inside acpi_button_remove() to use ACPI_ALL_NOTIFY, matching the installation path. Both stable and mainline branches receive the correction through kernel commits 614cb8c26c5aa53196ee9b211b76ee618b147d32 and fe80251152fed5b185f795ef2cd9f7fe9c3162e0. Distribution maintainers integrate these commits into their respective long-term support kernels.

Workarounds

Avoid unloading the button kernel module on affected systems until the patched kernel is deployed
Blacklist manual rmmod button operations through operational runbooks and configuration management
Limit CAP_SYS_MODULE privileges to trusted administrative accounts to reduce exposure to the removal path

bash

# Verify installed kernel version and check for the fix
uname -r
# Prevent runtime unload of the ACPI button driver until patched
echo 'install button /bin/true' | sudo tee /etc/modprobe.d/disable-button-unload.conf