CVE-2026-64511 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ACPI: NFIT: core: Fix possible NULL pointer dereference
After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler for the NFIT device before checking the presence of the NFIT table. If that table is not there, 0 is returned without allocating the acpi_desc object and setting the driver data pointer of the NFIT device. If the platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification on the NFIT device at that point, acpi_nfit_uc_error_notify() will dereference a NULL pointer.
Prevent that from occurring by adding an acpi_desc check against NULL to acpi_nfit_uc_error_notify().
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability resides within the Linux kernel's ACPI (Advanced Configuration and Power Interface) subsystem, specifically in the NFIT (NVDIMM Firmware Interface Table) driver component. The issue stems from a race condition and improper null pointer validation during the initialization sequence of the NFIT device handler. The vulnerability was introduced by commit 9b311b7313d6 which restructured the order of operations in the acpi_nfit_probe() function, moving the installation of the ACPI notify handler before the verification of the NFIT table's presence.
The technical flaw manifests when the system initializes the NFIT driver and installs a notify handler for potential memory error notifications before confirming that the required NFIT table actually exists in the platform firmware. If the NFIT table is absent from the system, the function returns early with a zero value without properly allocating the acpi_desc object or setting up the driver data pointer associated with the NFIT device. This creates a scenario where subsequent notification events can trigger the acpi_nfit_uc_error_notify() handler which attempts to dereference the uninitialized acpi_desc pointer, resulting in a NULL pointer dereference that will crash the kernel.
This vulnerability directly maps to CWE-476 which identifies NULL Pointer Dereference as a critical weakness in software systems. The operational impact of this flaw is significant as it can cause system crashes or kernel panics when platform firmware generates NFIT_NOTIFY_UC_MEMORY_ERROR notifications on systems without proper NFIT table support. The attack surface extends to systems running Linux kernels that have been patched with the problematic commit, particularly those utilizing NVDIMM (Non-Volatile Dual In-line Memory Module) hardware where memory error notifications might be generated by the platform firmware.
The mitigation strategy involves implementing a simple but crucial null pointer check within the acpi_nfit_uc_error_notify() function before any pointer dereference operations occur. This defensive programming approach ensures that notification handlers gracefully handle cases where initialization has not been completed or where the underlying data structures have not been properly allocated. The solution aligns with ATT&CK technique T1499.001 which covers Unauthorized Access to System Resources through kernel-level vulnerabilities, and follows the principle of least privilege by preventing unauthorized memory access patterns that could lead to system instability or potential privilege escalation.
This vulnerability represents a classic race condition scenario in kernel development where proper initialization sequence validation is missing, allowing for notification handlers to execute against partially initialized data structures. The fix demonstrates fundamental kernel security principles emphasizing the importance of null pointer validation and proper resource management during driver initialization phases. Systems without proper patching remain vulnerable to denial-of-service conditions that can be triggered by platform firmware error reporting mechanisms, making this a critical vulnerability for enterprise environments using NVDIMM technology or systems where ACPI memory error notifications are expected to occur.