CVE-2026-64511: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64511 Overview

CVE-2026-64511 is a NULL pointer dereference vulnerability in the Linux kernel's ACPI NFIT (NVDIMM Firmware Interface Table) subsystem. The flaw resides in acpi_nfit_uc_error_notify() within the ACPI NFIT core driver. Following commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table"), the acpi_nfit_probe() function installs an ACPI notify handler before verifying that the NFIT table exists. If the table is absent, the function returns without allocating the acpi_desc object or setting the driver data pointer. A subsequent NFIT_NOTIFY_UC_MEMORY_ERROR notification triggered by platform firmware then dereferences a NULL pointer, causing a kernel crash.

Critical Impact
A firmware-generated uncorrectable memory error notification on a system without an NFIT table can crash the Linux kernel, resulting in a local denial of service.

Affected Products

Linux kernel builds containing commit 9b311b7313d6 in the ACPI NFIT driver
Distributions shipping affected stable kernel branches prior to the referenced fix commits
Systems with ACPI-enabled platform firmware capable of issuing NFIT notifications

Discovery Timeline

2026-07-25 - CVE-2026-64511 published to the National Vulnerability Database
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64511

Vulnerability Analysis

The vulnerability is a classic NULL pointer dereference [CWE-476] in the Linux kernel ACPI NFIT driver. NFIT is an ACPI table that describes non-volatile memory devices such as NVDIMMs. The kernel driver registers a notify handler to process asynchronous firmware events including uncorrectable memory error notifications.

The defect was introduced by a prior fix that reordered handler installation to occur before the NFIT table presence check. That reordering created a window in which the notification callback is live but the driver context it depends on has not been allocated. When the callback fires during this window, it operates on an uninitialized driver data pointer.

Root Cause

Inside acpi_nfit_probe(), the ACPI notify handler is registered before the routine confirms whether the NFIT table is present on the system. If the table is missing, the probe returns 0 without allocating the acpi_desc object and without calling the equivalent of dev_set_drvdata() on the NFIT device. The notify callback acpi_nfit_uc_error_notify() retrieves the driver data and dereferences it without checking for NULL, leading to an oops when the firmware issues a NFIT_NOTIFY_UC_MEMORY_ERROR event.

The upstream patch resolves the issue by adding a NULL check for acpi_desc inside acpi_nfit_uc_error_notify() before any dereference occurs.

Attack Vector

Exploitation requires the platform firmware to generate an NFIT uncorrectable memory error notification against a system where the NFIT table is absent. This is not a remote attack vector. The impact is limited to kernel instability and denial of service on affected hosts. There is no evidence of remote exploitability or code execution potential associated with this NULL dereference. See the upstream commits referenced below for the exact source-level change.

// No verified exploit code available.
// Reference the upstream stable commits for the sanitized patch diff:
// https://git.kernel.org/stable/c/a44343fe230aa48c74ef09830f3c5c90848b257e

Detection Methods for CVE-2026-64511

Indicators of Compromise

Kernel oops or panic messages referencing acpi_nfit_uc_error_notify in dmesg or /var/log/kern.log
Unexpected reboots on systems configured with ACPI NFIT support but lacking an NFIT table
ACPI notification events logged around the time of a crash on hosts running affected kernel versions

Detection Strategies

Inventory running kernel versions across the fleet and compare them to the fixed stable commits published on git.kernel.org
Parse crash dumps and kdump output for stack traces containing ACPI NFIT symbols
Correlate host reboot telemetry with kernel log entries that mention NFIT or NVDIMM subsystem activity

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on BUG: or Oops: entries referencing ACPI subsystems
Track kernel package versions through configuration management to identify unpatched hosts
Monitor for repeated Machine Check Exception (MCE) events on NVDIMM-capable hardware

How to Mitigate CVE-2026-64511

Immediate Actions Required

Update the Linux kernel to a stable release that incorporates the referenced fix commits
Prioritize patching on servers that expose NVDIMM hardware or run firmware that generates NFIT notifications
Enable kdump to capture diagnostic data if a crash occurs before patching completes

Patch Information

The upstream fix adds a NULL check for the acpi_desc pointer in acpi_nfit_uc_error_notify() before dereferencing it. The change is available across multiple stable branches through the following commits: Kernel Git Commit 027e128, Kernel Git Commit 3c8f73b, Kernel Git Commit 4529456, Kernel Git Commit 873576e, and Kernel Git Commit a44343f. Apply distribution-provided kernel updates once vendors integrate these commits.

Workarounds

Blacklist the nfit kernel module on systems that do not require NVDIMM support using modprobe.d configuration
Disable ACPI NFIT handling in firmware settings where supported by the platform vendor
Restrict physical and administrative access to affected hosts until the patched kernel is deployed

bash

# Blacklist the NFIT module on systems that do not use NVDIMM hardware
echo "blacklist nfit" | sudo tee /etc/modprobe.d/blacklist-nfit.conf
sudo update-initramfs -u
sudo reboot