Answer in brief
CVE-2026-64510 records a High severity (CVSS 7.0) vulnerability in ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a61fe6f7902ecaa89d5e6c709490fc4324927134 <ee82078e776ae31266cc70fdf62ac17c3c6f100a || >=a61fe6f7902ecaa89d5e6c709490fc4324927134 <6ff054cc02a763914773b026cacb429e5fbf64fa || >=a61fe6f7902ecaa89d5e6c709490fc4324927134 <b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4 || >=a61fe6f7902ecaa89d5e6c709490fc4324927134 <c127dbd832bd4b9aef8a749d9f491b74042f9b47 || >=a61fe6f7902ecaa89d5e6c709490fc4324927134 <df7c92216a1583a76cb0cbf2f21cd68870609b05 || >=a61fe6f7902ecaa89d5e6c709490fc4324927134 <3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa || >=a61fe6f7902ecaa89d5e6c709490fc4324927134 <7d69235bdc581a4346e9bcd6a8bea37d3e1abd25 || >=a61fe6f7902ecaa89d5e6c709490fc4324927134 <38bf27511ef41bffebd157ec3eba41fc89ba59cd | ee82078e776ae31266cc70fdf62ac17c3c6f100a, 6ff054cc02a763914773b026cacb429e5fbf64fa, b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4, c127dbd832bd4b9aef8a749d9f491b74042f9b47, df7c92216a1583a76cb0cbf2f21cd68870609b05, 3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa, 7d69235bdc581a4346e9bcd6a8bea37d3e1abd25, 38bf27511ef41bffebd157ec3eba41fc89ba59cd |
| Linux/Linuxgeneric | 4.6 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdown() devm action is not added for the NFIT device in that case. Next, the acpi_nfit_init() failure causes acpi_nfit_probe() to fail, the acpi_desc object is freed, and a dangling pointer is left behind in the acpi_descs. Any subsequent ACPI Machine Check Exception will trigger nfit_handle_mce() which iterates over acpi_descs and so a use-after-free will occur. Moreover, if acpi_nfit_probe() returns 0 after installing a notify handler for the NFIT device and without allocating the acpi_desc object and setting the NFIT device's driver data pointer, the acpi_desc object will be allocated by acpi_nfit_update_notify() and acpi_nfit_init() will be called to initialize it. Regardless of whether or not acpi_nfit_init() fails in that case, the acpi_nfit_shutdown() devm action is not added for the NFIT device and acpi_desc is never removed from the acpi_descs list. If the acpi_desc object is freed subsequently on driver removal, any subsequent ACPI MCE will lead to a use-after-free like in the previous case. To address the first issue mentioned above, make acpi_nfit_probe() call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and to address the other one, add a remove callback to the driver and make it call acpi_nfit_shutdown(). Also, since it is now possible to pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it may not have been initialized, add checks against NULL for acpi_desc and its nvdimm_bus field to that function and make acpi_nfit_unregister() clear the latter after unregistering the NVDIMM bus.
Quoted source text, attributed separately from HOL analysis.