CVE-2026-64183 Overview
CVE-2026-64183 is a null pointer dereference vulnerability in the Linux kernel's Extensible Firmware Interface (EFI) subsystem. The flaw affects the interaction between Advanced Configuration and Power Interface (ACPI) Platform Runtime Mechanism (PRM) handlers and the EFI runtime workqueue. ACPI PRM calls can occur before efisubsys_init() allocates the workqueue used to dispatch these calls, resulting in a null pointer dereference during early kernel initialization. The issue was introduced by commit 5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers"), which delegated PRM invocations to a kernel-thread workqueue.
Critical Impact
Early-boot null pointer dereference in EFI/ACPI PRM handling can trigger a kernel crash before userspace initialization completes.
Affected Products
- Linux kernel versions containing commit 5894cf571e14 prior to the fix
- Systems using ACPI Platform Runtime Mechanism (PRM) handlers
- Systems relying on EFI runtime services during subsys_initcall() execution
Discovery Timeline
- 2026-07-19 - CVE-2026-64183 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64183
Vulnerability Analysis
The Linux kernel delegates ACPI PRM calls to a workqueue running in a kernel thread. This design allows the kernel to detect and mitigate faulting memory accesses performed by firmware code. The workqueue is allocated inside efisubsys_init(), which runs at subsys_initcall() level.
The problem arises because acpi_init() also runs at subsys_initcall() level and may trigger PRM accesses before efisubsys_init() executes. When PRM handlers dispatch work to a workqueue that has not yet been allocated, the kernel dereferences a null workqueue pointer.
Deferring acpi_init() is not viable because it has its own initcall ordering dependencies. The fix moves the workqueue allocation into a dedicated postcore_initcall(), which runs before all subsys_initcall() handlers. This guarantees the workqueue exists before any subsystem attempts EFI runtime calls, including PRM invocations.
Root Cause
The root cause is an initcall ordering flaw. Both acpi_init() and efisubsys_init() are registered as subsys_initcall() handlers, and their relative execution order does not guarantee that the EFI runtime workqueue exists before ACPI PRM handlers attempt to use it.
Attack Vector
This vulnerability is triggered during early kernel boot on systems that expose ACPI PRM handlers through firmware. The trigger is dependent on platform firmware behavior rather than direct attacker input. Successful triggering produces a kernel null pointer dereference, resulting in denial of service through a boot-time crash.
No public proof-of-concept exploit is available, and there is no evidence of exploitation in the wild. Refer to the upstream commits referenced below for the code-level fix.
Detection Methods for CVE-2026-64183
Indicators of Compromise
- Kernel oops or panic messages referencing null pointer dereference within EFI runtime or ACPI PRM code paths during boot
- Boot logs showing PRM handler invocation preceding EFI subsystem initialization
- Systems failing to complete boot on hardware exposing ACPI PRM tables
Detection Strategies
- Correlate kernel version against the fixed commits 13c6da02, 29cd94e6, 6996e954, c32a1fbe, and e871549f referenced in the upstream advisory
- Inspect dmesg and persistent kernel logs for stack traces involving efi_call_rts or ACPI PRM workqueue functions
- Audit firmware configurations that enable PRM handlers on affected kernel builds
Monitoring Recommendations
- Collect and centralize kernel crash logs from Linux hosts to identify recurring early-boot faults
- Track kernel package versions across the fleet to confirm the fix is applied
- Monitor vendor kernel advisories for backports of the referenced stable commits
How to Mitigate CVE-2026-64183
Immediate Actions Required
- Apply the upstream kernel fix that relocates the EFI runtime workqueue allocation to a postcore_initcall()
- Update to a Linux kernel release incorporating commits 13c6da02, 29cd94e6, 6996e954, c32a1fbe, or e871549f
- Reboot affected systems after patching to ensure the corrected initialization path is exercised
Patch Information
The fix splits the EFI runtime workqueue allocation into its own postcore_initcall(), ensuring the workqueue is available before any subsys_initcall() executes. Distribution kernel maintainers have backported the change through the stable tree commits listed in the Linux kernel git repository.
Workarounds
- Disable ACPI PRM handler usage in firmware settings where the platform permits, eliminating the code path that triggers the null dereference
- Boot with a kernel version that predates commit 5894cf571e14 if patching is not immediately feasible and platform support allows
- Restrict deployment of affected kernel builds on hardware known to expose PRM tables until the fix is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
