{"id":"CVE-2026-64510","state":"PUBLISHED","title":"ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: NFIT: core: Fix acpi_nfit_init() error cleanup\n\nIf acpi_nfit_init() fails after adding the acpi_desc object to the\nacpi_descs list, that object is never removed from that list because\nthe acpi_nfit_shutdown() devm action is not added for the NFIT device\nin that case.  Next, the acpi_nfit_init() failure causes\nacpi_nfit_probe() to fail, the acpi_desc object is freed, and a\ndangling pointer is left behind in the acpi_descs.  Any subsequent\nACPI Machine Check Exception will trigger nfit_handle_mce() which\niterates over acpi_descs and so a use-after-free will occur.\n\nMoreover, if acpi_nfit_probe() returns 0 after installing a notify\nhandler for the NFIT device and without allocating the acpi_desc\nobject and setting the NFIT device's driver data pointer, the\nacpi_desc object will be allocated by acpi_nfit_update_notify()\nand acpi_nfit_init() will be called to initialize it.  Regardless\nof whether or not acpi_nfit_init() fails in that case, the\nacpi_nfit_shutdown() devm action is not added for the NFIT device\nand acpi_desc is never removed from the acpi_descs list.  If the\nacpi_desc object is freed subsequently on driver removal, any\nsubsequent ACPI MCE will lead to a use-after-free like in the\nprevious case.\n\nTo address the first issue mentioned above, make acpi_nfit_probe()\ncall acpi_nfit_shutdown() directly on acpi_nfit_init() failures and\nto address the other one, add a remove callback to the driver and\nmake it call acpi_nfit_shutdown().  Also, since it is now possible to\npass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it\nmay not have been initialized, add checks against NULL for acpi_desc and\nits nvdimm_bus field to that function and make acpi_nfit_unregister()\nclear the latter after unregistering the NVDIMM bus.","publishedAt":"2026-07-25T08:52:03.208Z","updatedAt":"2026-10-19T20:48:37.449Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"ee82078e776ae31266cc70fdf62ac17c3c6f100a","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"6ff054cc02a763914773b026cacb429e5fbf64fa","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"c127dbd832bd4b9aef8a749d9f491b74042f9b47","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"df7c92216a1583a76cb0cbf2f21cd68870609b05","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"7d69235bdc581a4346e9bcd6a8bea37d3e1abd25","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"38bf27511ef41bffebd157ec3eba41fc89ba59cd","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/acpi/nfit/core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.6","versionType":"semver"},{"version":"5.10.261","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/acpi/nfit/core.c"]}],"references":["https://git.kernel.org/stable/c/ee82078e776ae31266cc70fdf62ac17c3c6f100a","https://git.kernel.org/stable/c/6ff054cc02a763914773b026cacb429e5fbf64fa","https://git.kernel.org/stable/c/b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4","https://git.kernel.org/stable/c/c127dbd832bd4b9aef8a749d9f491b74042f9b47","https://git.kernel.org/stable/c/df7c92216a1583a76cb0cbf2f21cd68870609b05","https://git.kernel.org/stable/c/3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa","https://git.kernel.org/stable/c/7d69235bdc581a4346e9bcd6a8bea37d3e1abd25","https://git.kernel.org/stable/c/38bf27511ef41bffebd157ec3eba41fc89ba59cd"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64510.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64510","state":"PUBLISHED","datePublished":"2026-07-25T08:52:03.208Z","dateUpdated":"2026-10-19T20:48:37.449Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T15:36:31.793Z"},"containers":{"cna":{"title":"ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: NFIT: core: Fix acpi_nfit_init() error cleanup\n\nIf acpi_nfit_init() fails after adding the acpi_desc object to the\nacpi_descs list, that object is never removed from that list because\nthe acpi_nfit_shutdown() devm action is not added for the NFIT device\nin that case.  Next, the acpi_nfit_init() failure causes\nacpi_nfit_probe() to fail, the acpi_desc object is freed, and a\ndangling pointer is left behind in the acpi_descs.  Any subsequent\nACPI Machine Check Exception will trigger nfit_handle_mce() which\niterates over acpi_descs and so a use-after-free will occur.\n\nMoreover, if acpi_nfit_probe() returns 0 after installing a notify\nhandler for the NFIT device and without allocating the acpi_desc\nobject and setting the NFIT device's driver data pointer, the\nacpi_desc object will be allocated by acpi_nfit_update_notify()\nand acpi_nfit_init() will be called to initialize it.  Regardless\nof whether or not acpi_nfit_init() fails in that case, the\nacpi_nfit_shutdown() devm action is not added for the NFIT device\nand acpi_desc is never removed from the acpi_descs list.  If the\nacpi_desc object is freed subsequently on driver removal, any\nsubsequent ACPI MCE will lead to a use-after-free like in the\nprevious case.\n\nTo address the first issue mentioned above, make acpi_nfit_probe()\ncall acpi_nfit_shutdown() directly on acpi_nfit_init() failures and\nto address the other one, add a remove callback to the driver and\nmake it call acpi_nfit_shutdown().  Also, since it is now possible to\npass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it\nmay not have been initialized, add checks against NULL for acpi_desc and\nits nvdimm_bus field to that function and make acpi_nfit_unregister()\nclear the latter after unregistering the NVDIMM bus."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"ee82078e776ae31266cc70fdf62ac17c3c6f100a","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"6ff054cc02a763914773b026cacb429e5fbf64fa","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"c127dbd832bd4b9aef8a749d9f491b74042f9b47","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"df7c92216a1583a76cb0cbf2f21cd68870609b05","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"7d69235bdc581a4346e9bcd6a8bea37d3e1abd25","versionType":"git"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","status":"affected","lessThan":"38bf27511ef41bffebd157ec3eba41fc89ba59cd","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/acpi/nfit/core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.6","versionType":"semver"},{"version":"5.10.261","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/acpi/nfit/core.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ee82078e776ae31266cc70fdf62ac17c3c6f100a"},{"url":"https://git.kernel.org/stable/c/6ff054cc02a763914773b026cacb429e5fbf64fa"},{"url":"https://git.kernel.org/stable/c/b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4"},{"url":"https://git.kernel.org/stable/c/c127dbd832bd4b9aef8a749d9f491b74042f9b47"},{"url":"https://git.kernel.org/stable/c/df7c92216a1583a76cb0cbf2f21cd68870609b05"},{"url":"https://git.kernel.org/stable/c/3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa"},{"url":"https://git.kernel.org/stable/c/7d69235bdc581a4346e9bcd6a8bea37d3e1abd25"},{"url":"https://git.kernel.org/stable/c/38bf27511ef41bffebd157ec3eba41fc89ba59cd"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - No network, wireless, or user-namespace interface reaches this path; the highest reasonable attack path is a local process triggering a qualifying MCE through an accessible poisoned memory mapping.\nAC:H - Exploitation requires a descriptor already made stale by NFIT initialization failure or late initialization followed by removal, plus a usable-address uncorrectable MCE. An unprivileged attacker cannot reliably create all these firmware and hardware conditions.\nPR:L - Once the stale state and poisoned mapping exist, a basic local account can trigger the MCE and spray reclaimed heap memory without capabilities. Deterministic driver removal or software MCE injection is root-only, but is unnecessary in this higher-severity plausible scenario.\nUI:N - No action by another user is required after the vulnerable system state exists; the attacker can access the relevant memory directly.\nS:U - The UAF compromises the same host kernel and does not inherently cross a VM, IOMMU, or other security-authority boundary.\nC:H - The freed descriptor and its subordinate SPA objects contain attacker-reclaimable pointers and linked lists, permitting controlled kernel-memory dereferences and potential arbitrary disclosure.\nI:H - Locking the freed embedded mutex already writes to reclaimed memory, while controlled bus, region, and list pointers can provide stronger write primitives and potential kernel code execution.\nA:H - The dangling descriptor is traversed during MCE processing and can cause an invalid mutex operation, invalid pointer dereference, deadlock, oops, or kernel panic, as established by the [published record](https://nvd.nist.gov/vuln/detail/CVE-2026-64510)."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T04:57:01.009Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"5.10.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"7.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-64510","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:41:28.832636Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:48:37.449Z"}}]}}}