CVE-2026-64510

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup

If acpi_nfit_init() fails after adding the acpi_desc object to the

acpi_descs list, that object is never removed from that list because

the acpi_nfit_shutdown() devm action is not added for the NFIT device

in that case. Next, the acpi_nfit_init() failure causes

acpi_nfit_probe() to fail, the acpi_desc object is freed, and a

dangling pointer is left behind in the acpi_descs. Any subsequent

ACPI Machine Check Exception will trigger nfit_handle_mce() which

iterates over acpi_descs and so a use-after-free will occur.

Moreover, if acpi_nfit_probe() returns 0 after installing a notify

handler for the NFIT device and without allocating the acpi_desc

object and setting the NFIT device's driver data pointer, the

acpi_desc object will be allocated by acpi_nfit_update_notify()

and acpi_nfit_init() will be called to initialize it. Regardless

of whether or not acpi_nfit_ini

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References