CVE-2026-64603 Overview
CVE-2026-64603 is a race condition in the Linux kernel platform/x86: intel-hid driver. The notify_handler() ACPI callback can run concurrently on multiple CPU cores after commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs"). On convertible and detachable devices matched by DMI chassis types 31 and 32, the SW_TABLET_MODE input device is registered lazily via intel_hid_switches_setup() on the first tablet-mode event. Concurrent events can both pass the !priv->switches check, registering the input device twice and producing a duplicate sysfs entry followed by a NULL pointer dereference.
Critical Impact
Concurrent ACPI notify events on convertibles can cause a duplicate input device registration and a subsequent NULL pointer dereference, leading to a kernel crash.
Affected Products
- Linux kernel builds including the intel-hid platform driver after commit e2ffcda16290
- Convertible and detachable x86 devices identified by DMI chassis-type 31 and 32
- Distributions shipping the affected platform/x86 subsystem prior to the referenced stable fixes
Discovery Timeline
- 2026-08-06 - CVE-2026-64603 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-64603
Vulnerability Analysis
The defect is a race condition [CWE-362] in the intel-hid ACPI notify handler. Since the referenced ACPI OSL change, notify callbacks are dispatched without a global serialization guarantee. Two tablet-mode events arriving on separate CPUs both observe priv->switches as NULL and both proceed to allocate and register a new input device. The kernel then attempts to create a sysfs entry that already exists and subsequently dereferences state that only one path fully initialized. The result is a duplicate registration warning followed by a NULL pointer dereference in kernel context.
Root Cause
The lazy initialization pattern inside intel_hid_switches_setup() was written assuming serial invocation of notify_handler(). There is no lock protecting the check-then-act sequence around priv->switches. Once ACPI Notify handlers were permitted to run on all CPUs, the check and the subsequent registration became a classic time-of-check-to-time-of-use window. The sibling intel-vbtn driver received the same class of fix earlier in commit e075c3b13a0a.
Attack Vector
Triggering the race requires local hardware conditions on an affected convertible or detachable device, specifically two closely spaced tablet-mode transition events reaching the ACPI subsystem. The primary observable outcome is a kernel crash rather than a memory disclosure or privilege escalation primitive. Exploitation is bounded by the need for physical or firmware-level ability to generate rapid ACPI notifications on matching chassis types.
No public proof-of-concept code has been published. The upstream fix serializes notify_handler() with a mutex; see the stable tree commits 86df6499dfd2, a6402808e552, c085d82613d5, and eace3b3e729d referenced by the advisory.
Detection Methods for CVE-2026-64603
Indicators of Compromise
- Kernel log entries reporting duplicate sysfs entry creation attempts originating from the intel-hid module
- NULL pointer dereference oops traces whose call stack includes intel_hid_switches_setup or notify_handler
- Unexpected reboots or kernel panics on convertible or detachable Intel-based hardware coinciding with device mode changes
Detection Strategies
- Query installed kernel package versions across the fleet and compare against the fixed stable releases listed in the kernel.org commits
- Parse /var/log/kern.log, journalctl -k, and crash dumps for stack frames containing intel_hid symbols
- Inventory hardware by DMI chassis type and flag systems reporting chassis-type 31 or 32 running unpatched kernels
Monitoring Recommendations
- Forward kernel oops and panic events to a centralized log platform and alert on intel-hid symbols in fault stacks
- Track dmesg warnings referencing duplicate sysfs entries under /sys/devices/platform/
- Correlate device-mode transition telemetry with kernel stability events on convertible endpoints
How to Mitigate CVE-2026-64603
Immediate Actions Required
- Apply the upstream stable kernel updates that introduce mutex protection in intel-hidnotify_handler()
- Prioritize patching for convertible and detachable endpoints identified by DMI chassis-type 31 or 32
- Enable automatic kernel security updates on managed Linux fleets to receive the fix through distribution channels
Patch Information
The fix wraps notify_handler() in a mutex to prevent recursion between concurrent ACPI notifications. It is available in the Linux stable tree via commits 86df6499dfd2, a6402808e552, c085d82613d5, and eace3b3e729d. Rebuild custom kernels from these references or upgrade to a distribution kernel that has merged the fix.
Workarounds
- Unload the intel-hid module on affected convertibles where tablet-mode switching is not required until the patched kernel is deployed
- Blacklist intel-hid via /etc/modprobe.d/ on non-critical endpoints to prevent the vulnerable code path from executing
- Restrict physical access to affected devices to reduce the likelihood of triggering rapid mode-change events
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
