CVE-2026-64180: Linux Kernel Privilege Escalation Flaw

CVE-2026-64180 Overview

CVE-2026-64180 is a memory leak vulnerability in the Linux kernel's memory hotplug subsystem. The flaw resides in the remove_memory_blocks_and_altmaps() function within mm/memory_hotplug. This function calls find_memory_block() to look up each memory block, which acquires a reference to the memory block device. The reference is never released on that code path, causing a device reference leak whenever memory blocks and their altmaps are removed. The issue affects Linux systems that use memory hot-remove operations, including virtualized environments, NUMA-aware servers, and systems using persistent memory (PMEM) with altmap-backed device memory.

Critical Impact
Repeated memory hot-remove operations leak struct device references, preventing proper cleanup of kernel objects and potentially destabilizing memory management state over time.

Affected Products

Linux kernel versions containing the affected mm/memory_hotplug implementation prior to the referenced stable commits
Distributions shipping vulnerable kernels with memory hotplug (CONFIG_MEMORY_HOTPLUG) enabled
Systems using altmap-backed device memory, including DAX and PMEM configurations

Discovery Timeline

2026-07-19 - CVE-2026-64180 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64180

Vulnerability Analysis

The vulnerability is a memory block device reference leak [Memory Leak] in the Linux kernel memory hotplug path. When memory blocks are removed, remove_memory_blocks_and_altmaps() iterates over the affected memory range and calls find_memory_block() for each block. find_memory_block() returns a pointer to the underlying struct memory_block and increments the reference count on the associated struct device through the kobject subsystem. The original code retrieves mem->altmap, clears it, and then removes the memory block device without ever calling put_device() on the reference obtained during lookup. Each removed memory block therefore leaks one device reference. Over the lifetime of a long-running system that performs repeated hot-plug and hot-remove cycles, the leaked references accumulate. This can prevent the underlying device objects from being freed, keep parent objects pinned, and interfere with subsequent memory hotplug operations that rely on clean teardown state.

Root Cause

The root cause is a missing put_device() call after find_memory_block() in the memory block removal path. The lookup function returns a referenced object, and callers must drop that reference once finished. The removal routine violated this contract by consuming mem->altmap and then removing the block without balancing the reference acquired at lookup time.

Attack Vector

The vulnerability requires local privileges sufficient to trigger memory hot-remove operations, which is typically restricted to root or the kernel itself acting on hypervisor events. There is no known remote attack path. Repeated hot-remove cycles are required to accumulate leaks large enough to affect stability. No public proof-of-concept exploit is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.157%.

No verified exploitation code is available for this issue. See the upstream commits referenced under Patch Information for the exact source-level change that resolves the leak.

Detection Methods for CVE-2026-64180

Indicators of Compromise

Growing kobject or struct device counts under /sys/devices/system/memory/ that do not decrease after memory hot-remove events.
Kernel warnings or refcount imbalances logged during memory hotplug operations in dmesg.
Unusual persistence of memory block sysfs entries after successful hot-remove operations.

Detection Strategies

Compare the running kernel version and commit hash against the fixed stable commits (09ce9230, 93866f55, b8ab30c7, df64c0d2).
Instrument memory hotplug workflows in test environments and monitor /proc/slabinfo and device counts to detect reference accumulation.
Review host and guest kernel changelogs to confirm the memory hotplug patch is included.

Monitoring Recommendations

Track kernel log output for memory hotplug errors and device removal anomalies on hosts that perform ballooning or DAX/PMEM operations.
Baseline memory block device counts on long-running systems and alert on unbounded growth.
Correlate hypervisor-driven memory hot-remove events with post-operation kernel object counts to identify leaks.

How to Mitigate CVE-2026-64180

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable commit updates to all affected systems.
Prioritize patching hosts that perform frequent memory hot-plug or hot-remove operations, including virtualization hosts and PMEM-enabled servers.
Rebuild or update distribution kernels to a version that includes the fix and reboot affected systems.

Patch Information

The fix drops the memory block device reference after retrieving and clearing mem->altmap and before removing the memory block device. The upstream fix is available in the following kernel.org stable commits: 09ce923071e7, 93866f55f7e2, b8ab30c79fc0, and df64c0d21c3f.

Workarounds

Avoid repeated memory hot-remove operations on unpatched systems where feasible.
Restrict local privileges required to initiate memory hotplug operations to trusted administrators only.
Schedule reboots on long-running hosts that cannot be patched immediately to reset accumulated leaked references.

bash

# Verify running kernel and check whether the fix commit is present
uname -r
zcat /proc/config.gz 2>/dev/null | grep CONFIG_MEMORY_HOTPLUG
git -C /path/to/linux log --oneline | grep -E "09ce9230|93866f55|b8ab30c7|df64c0d2"