CVE-2026-64182 Overview
CVE-2026-64182 is a memory leak vulnerability in the Linux kernel affecting the drivers/base/memory subsystem. The flaw resides in the poison accounting helpers memblk_nr_poison_inc() and memblk_nr_poison_sub(), which look up a memory block through find_memory_block_by_id(). This lookup function acquires a reference to the memory block device, but the callers use the returned pointer without releasing that reference. Each successful lookup leaks a device reference counter, gradually consuming kernel resources tied to memory block lifecycle tracking.
Critical Impact
The reference leak prevents proper release of memory block device structures during hardware poison accounting, degrading kernel resource management over time.
Affected Products
- Linux kernel drivers/base/memory subsystem
- Kernel builds implementing hardware poison accounting via memblk_nr_poison_inc() and memblk_nr_poison_sub()
- Stable kernel branches receiving the referenced patch commits
Discovery Timeline
- 2026-07-19 - CVE-2026-64182 published to the National Vulnerability Database
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64182
Vulnerability Analysis
The vulnerability is a memory leak tied to reference counting on memory block device objects. In the Linux kernel, find_memory_block_by_id() returns a pointer to a memory_block structure and increments the underlying device kobject reference count. Callers are expected to drop the reference with put_device() once the object is no longer needed.
Both memblk_nr_poison_inc() and memblk_nr_poison_sub() invoke this lookup to update the nr_hwpoison counter that tracks poisoned pages within a memory block. Neither helper released the acquired reference after updating the counter. Each call path that increments or decrements the hardware poison count therefore leaks one device reference.
Over time, leaked references keep memory block device structures alive past their expected lifetime. This interferes with memory hotplug operations that depend on clean teardown of struct memory_block. Systems that encounter frequent memory errors or run workloads that stress the memory hotplug subsystem are most exposed to the accumulated leak.
Root Cause
The root cause is missing put_device() calls in the poison accounting helpers after find_memory_block_by_id() returns. The API contract for the lookup function requires callers to balance the implicit reference acquisition, and both helpers violated that contract.
Attack Vector
The issue is not directly reachable by unprivileged users through a network interface. Exploitation requires conditions that trigger memblk_nr_poison_inc() or memblk_nr_poison_sub(), primarily hardware memory error events or code paths that mark pages as poisoned. Repeated triggering degrades kernel bookkeeping and can obstruct memory hot-remove operations. The published data does not indicate remote exploitation or a public proof of concept.
The vulnerability is described in prose only; refer to the upstream commits for the source-level fix. See Kernel Git Commit ce60d94 for the mainline change.
Detection Methods for CVE-2026-64182
Indicators of Compromise
- Growing kobject reference counts on memory block devices in /sys/devices/system/memory/
- Memory hot-remove operations failing with -EBUSY on affected kernels
- Kernel log entries referencing memory_block teardown failures after hardware poison events
Detection Strategies
- Compare the running kernel version against the fixed commits 03a2cc1, 24840b3, 686b428, 8502e2c, and ce60d94 referenced on kernel.org.
- Audit fleet inventory for kernels that predate the stable backport of the poison accounting fix.
- Correlate hardware poison event counts with memory hotplug failure telemetry to identify latent leaks.
Monitoring Recommendations
- Track HardwareCorrupted counters and memory block sysfs attributes over long uptime windows.
- Alert on unexpected refusal of memory offline requests following machine check events.
- Ingest kernel logs into centralized analytics to identify patterns consistent with the leak.
How to Mitigate CVE-2026-64182
Immediate Actions Required
- Apply the upstream fix from Kernel Git Commit ce60d94 or the corresponding stable backport for your kernel branch.
- Update to a distribution kernel package that incorporates the patched drivers/base/memory sources.
- Reboot affected systems after patch installation to clear any accumulated leaked references.
Patch Information
The fix drops the memory block device reference after updating nr_hwpoison in both helper functions. Stable backports are available at Kernel Git Commit 03a2cc1, Kernel Git Commit 24840b3, Kernel Git Commit 686b428, and Kernel Git Commit 8502e2c.
Workarounds
- No functional workaround eliminates the leak without the source-level patch.
- Schedule periodic reboots on long-running systems that cannot be patched immediately to reset kernel reference counters.
- Restrict operations that force memory poison accounting on unpatched systems where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
