CVE-2026-64510: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64510 Overview

CVE-2026-64510 is a use-after-free vulnerability in the Linux kernel's ACPI NVDIMM Firmware Interface Table (NFIT) core driver. The flaw resides in the acpi_nfit_init() error cleanup path, where a failure to remove a stale acpi_desc object from the acpi_descs list leaves a dangling pointer after the object is freed. Any subsequent ACPI Machine Check Exception (MCE) triggers nfit_handle_mce(), which iterates over acpi_descs and dereferences the freed memory. The vulnerability requires local access with low privileges and carries high impact on confidentiality, integrity, and availability.

Critical Impact
A local attacker capable of triggering an ACPI MCE on an affected system can cause kernel memory corruption via use-after-free, leading to denial of service or potential privilege escalation.

Affected Products

Linux kernel branches containing the ACPI NFIT core driver prior to the fix commits
Systems exposing NVDIMM devices via ACPI NFIT
Distributions shipping vulnerable kernel versions pending backport

Discovery Timeline

2026-07-25 - CVE-2026-64510 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64510

Vulnerability Analysis

The defect lives in the Linux kernel ACPI NFIT core driver, which manages non-volatile DIMM descriptors. When acpi_nfit_init() fails after adding an acpi_desc object to the acpi_descs list, the cleanup path never removes that object. Because the acpi_nfit_shutdown() devm action is not registered for the NFIT device in that failure path, the acpi_desc is freed while its pointer remains linked in acpi_descs.

A second variant of the same class exists. When acpi_nfit_probe() returns success after installing a notify handler but without allocating the acpi_desc or setting driver data, the allocation later occurs inside acpi_nfit_update_notify(). That allocation path also fails to register acpi_nfit_shutdown() as a devm action. On driver removal, the object is freed while still referenced by the list.

Any later ACPI Machine Check Exception invokes nfit_handle_mce(), which walks acpi_descs and dereferences the dangling pointer, producing a use-after-free condition in kernel context [CWE-416].

Root Cause

The root cause is asymmetric resource management between initialization and teardown. The driver adds acpi_desc to a global list before registering the corresponding devm cleanup action. When initialization aborts, the object outlives its cleanup contract, leaving list membership without an owner responsible for removal.

Attack Vector

Exploitation requires local access with low privileges on a system that exposes an NFIT device. An attacker must induce failure conditions in acpi_nfit_init() or driver removal, then trigger an ACPI MCE to invoke nfit_handle_mce(). Successful exploitation dereferences freed kernel memory. Attack complexity is high because it depends on precise timing and hardware state, which is reflected in the CVSS vector.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the upstream commits such as Linux Kernel Commit ee82078 for the corrective code.

Detection Methods for CVE-2026-64510

Indicators of Compromise

Kernel oops or panic messages referencing nfit_handle_mce, acpi_nfit_shutdown, or acpi_descs list traversal
Unexpected system crashes correlated with ACPI Machine Check Exception events
KASAN reports flagging use-after-free in the ACPI NFIT subsystem on instrumented kernels

Detection Strategies

Audit installed kernel package versions against distribution advisories referencing the fix commits listed under external references
Enable and monitor Kernel Address Sanitizer (KASAN) in test environments running NFIT-enabled hardware or QEMU NVDIMM emulation
Correlate dmesg output with MCE events reported through mcelog or rasdaemon to identify anomalous crashes tied to NFIT teardown

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on stack traces referencing nfit_handle_mce or acpi_nfit_probe failures
Track host uptime and reboot patterns on systems with NVDIMM hardware to identify repeated crashes indicative of triggering conditions
Inventory hosts exposing NFIT devices by reading /sys/firmware/acpi/tables/NFIT and prioritize them for patching

How to Mitigate CVE-2026-64510

Immediate Actions Required

Apply vendor kernel updates that incorporate the upstream fixes referenced by commits 38bf275, 3b2628f, 6ff054c, 7d69235, b07d22a, c127dbd, df7c922, and ee82078
Prioritize patching on systems with NVDIMM hardware and any host handling ACPI MCE events
Restrict local access on affected hosts until patches are deployed, since exploitation requires local privileges

Patch Information

The upstream fix modifies acpi_nfit_probe() to call acpi_nfit_shutdown() directly on acpi_nfit_init() failures. It also adds a remove callback that invokes acpi_nfit_shutdown() during driver teardown. The shutdown routine gains NULL checks for acpi_desc and its nvdimm_bus field, and acpi_nfit_unregister() clears the nvdimm_bus pointer after unregistering the NVDIMM bus. Distribution kernel updates that backport these changes are the authoritative remediation. See the reference commits, for example Linux Kernel Commit 38bf275 and Linux Kernel Commit df7c922.

Workarounds

Where feasible, disable NVDIMM support in the kernel configuration on systems that do not require it by unloading or blacklisting the nfit module
Enforce strict local-user access controls and audit privileged accounts on hosts exposing NFIT devices
Isolate affected hosts from untrusted workloads until kernel updates are applied

bash

# Blacklist the NFIT module on systems that do not require NVDIMM support
echo 'blacklist nfit' | sudo tee /etc/modprobe.d/blacklist-nfit.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep nfit