CVE-2026-64182 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
drivers/base/memory: fix memory block reference leak in poison accounting
memblk_nr_poison_inc() and memblk_nr_poison_sub() look up a memory block via find_memory_block_by_id(), which acquires a reference to the memory block device.
Both helpers use the returned memory block without dropping that reference, leaking the device reference on each successful lookup. Drop the reference after updating nr_hwpoison.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides in the linux kernel's memory management subsystem particularly within the drivers/base/memory directory where improper reference counting leads to resource leakage. This issue affects the poison accounting mechanism that tracks hardware poison events in memory blocks. The flaw manifests in two specific helper functions memblk_nr_poison_inc() and memblk_nr_poison_sub() which are responsible for incrementing and decrementing the hardware poison counter for memory blocks. Both functions utilize find_memory_block_by_id() to locate the appropriate memory block device, a process that inherently acquires a reference to the device object. The critical oversight occurs when these helper functions fail to release the acquired reference after successfully updating the nr_hwpoison counter value.
The technical implementation flaw stems from improper resource management where device references are obtained through find_memory_block_by_id() but never properly released. This creates a cumulative reference leak that grows with each invocation of the poison accounting functions. The memory block device objects maintain internal reference counts that, when incremented without corresponding decrements, prevent proper garbage collection and resource deallocation. As the kernel processes hardware poison events repeatedly, each operation contributes to an ever-increasing reference count on the memory block devices, ultimately leading to resource exhaustion and potential system instability.
The operational impact of this vulnerability extends beyond simple memory consumption issues as it affects system reliability and performance over time. The reference leak can eventually cause memory allocation failures within the kernel's device management subsystem, potentially leading to denial of service conditions where the system cannot properly manage memory resources. This becomes particularly problematic in systems with high hardware poison event rates or those running extended periods without rebooting. The leak also impacts the kernel's ability to properly cleanup and reuse memory block device objects, creating a degradation in overall system performance and resource utilization.
This vulnerability aligns with CWE-404, specifically the weakness related to improper resource release or unbalanced resource management, and demonstrates characteristics consistent with ATT&CK technique T1490 which involves data destruction through resource exhaustion. The fix implements proper reference counting by ensuring that after updating the nr_hwpoison counter value, the acquired reference from find_memory_block_by_id() is explicitly dropped through appropriate reference release mechanisms. This remediation follows standard kernel development practices for managing device references and prevents the accumulation of unused references that would otherwise persist in memory until system reboot.
The resolution addresses fundamental kernel resource management principles where every reference acquired must have a corresponding release operation to maintain proper object lifecycle management. This fix ensures that memory block device objects can be properly reclaimed by the kernel's memory management subsystem, preventing the progressive degradation of system resources that would occur from the reference leak. The implementation requires minimal code changes focused solely on adding the missing reference drop operation after the poison counter update, making it a targeted and safe resolution to the memory accounting issue. The fix aligns with kernel development standards and maintains backward compatibility while restoring proper resource management behavior throughout the memory poison accounting subsystem.
The vulnerability demonstrates how seemingly minor reference counting errors can compound over time to create significant operational issues in kernel space. In production systems where hardware poison events occur regularly due to memory faults or other hardware anomalies, this leak would progressively consume available memory resources and potentially impact system stability. The fix ensures that the kernel's memory management remains efficient and that device objects can be properly recycled, maintaining system performance and resource availability for legitimate operations. This represents a classic example of how proper resource management practices are essential in kernel development to prevent subtle but impactful issues that may not manifest immediately but grow over time.