CVE-2026-64244: Linux Kernel Privilege Escalation Flaw

CVE-2026-64244 Overview

CVE-2026-64244 is a Linux kernel flaw in the memory device subsystem (drivers/base/memory). The vulnerability stems from an ordering error where mem->altmap is assigned before __add_memory_block() completes successfully. When __add_memory_block() fails at xa_store() under conditions such as memory pressure, the kernel invokes device_unregister(), which triggers memory_block_release() while mem->altmap is still set. This condition triggers a WARN_ON(mem->altmap) in the release path. The issue was observed while modifying the virtio-mem driver.

Critical Impact
The flaw produces kernel warnings and inconsistent state during memory hot-add failure paths, affecting systems that rely on memory hotplug and altmap-backed device memory.

Affected Products

Linux kernel (multiple stable branches, per kernel.org stable commits)
Systems using memory hotplug with altmap support
Deployments using the virtio-mem driver

Discovery Timeline

2026-07-24 - CVE-2026-64244 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64244

Vulnerability Analysis

The defect resides in the memory block registration flow within drivers/base/memory. The function __add_memory_block() performs multiple operations including an xa_store() call that inserts the memory block into an XArray index. Prior to the fix, mem->altmap was assigned before the registration path completed. If xa_store() failed, control transferred to an error path that called device_unregister(). That path eventually invoked memory_block_release(), which contains a WARN_ON(mem->altmap) guard because release is not expected to encounter an assigned altmap in this failure scenario.

The result is a kernel warning and disrupted cleanup of a partially initialized memory block. Systems performing memory hotplug operations under memory pressure are the most exposed to the failure path.

Root Cause

The root cause is a state initialization ordering error. The mem->altmap pointer is set too early in the registration sequence. When the later xa_store() step fails, the release routine observes an altmap value that violates its precondition, producing the WARN_ON splat.

Attack Vector

The condition requires triggering __add_memory_block() failure, typically through memory pressure during hotplug or by exercising drivers such as virtio-mem that provide device memory with altmap. Reachability from unprivileged contexts is limited by the requirement to invoke kernel memory hotplug paths. The vulnerability is a reliability defect surfaced as a warning rather than a memory-safety exploit primitive.

Code-level details are documented in the upstream fixes; see Kernel Git Commit a2b8d78 and Kernel Git Commit 059ac62 for the corrected assignment order.

Detection Methods for CVE-2026-64244

Indicators of Compromise

Kernel log entries containing WARN_ON originating in memory_block_release() with mem->altmap set
Failed memory hotplug operations correlated with xa_store() errors under memory pressure
Stack traces referencing __add_memory_block, device_unregister, and memory_block_release

Detection Strategies

Monitor dmesg and journal output for kernel warnings tied to memory block release paths
Correlate memory hotplug failure events with virtio-mem driver activity on virtualized workloads
Track kernel version and stable branch level against the fix commits listed on kernel.org

Monitoring Recommendations

Forward kernel logs to a centralized log store and alert on WARN_ON occurrences in drivers/base/memory
Baseline memory hotplug operations on virtio-mem hosts to identify anomalous failure rates
Include kernel version inventory in configuration management to verify patch coverage

How to Mitigate CVE-2026-64244

Immediate Actions Required

Identify hosts running affected Linux kernel versions, particularly those using memory hotplug or virtio-mem
Apply the stable kernel updates that include the corrected mem->altmap assignment order
Reboot systems into the patched kernel to activate the fix

Patch Information

The upstream fix delays the assignment of mem->altmap until after __add_memory_block() succeeds. Corresponding stable commits are available at Kernel Git Commit 22dc0d0, Kernel Git Commit 6c25bf4, Kernel Git Commit 802e113, Kernel Git Commit a2b8d78, Kernel Git Commit bc3dd82, and Kernel Git Commit 059ac62. Distribution vendors ship the fix through their standard kernel update channels.

Workarounds

Avoid triggering memory hotplug operations on affected kernels while under high memory pressure
Limit use of the virtio-mem driver on unpatched hosts until updates are applied
Track kernel warnings and remediate through patching rather than by suppressing WARN_ON output

bash

# Verify running kernel and check for the patched commit on the local system
uname -r
apt list --installed 2>/dev/null | grep linux-image   # Debian/Ubuntu
rpm -qa | grep kernel                                   # RHEL/Fedora/SUSE