CVE-2026-64511

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: NFIT: core: Fix possible NULL pointer dereference

After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before

getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler

for the NFIT device before checking the presence of the NFIT table. If

that table is not there, 0 is returned without allocating the acpi_desc

object and setting the driver data pointer of the NFIT device. If the

platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification

on the NFIT device at that point, acpi_nfit_uc_error_notify() will

dereference a NULL pointer.

Prevent that from occurring by adding an acpi_desc check against NULL

to acpi_nfit_uc_error_notify().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References