PT-2026-64731 · Linux · Linux
CVE-2026-64510
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
ACPI: NFIT: core: Fix acpi nfit init() error cleanup
If acpi nfit init() fails after adding the acpi desc object to the
acpi descs list, that object is never removed from that list because
the acpi nfit shutdown() devm action is not added for the NFIT device
in that case. Next, the acpi nfit init() failure causes
acpi nfit probe() to fail, the acpi desc object is freed, and a
dangling pointer is left behind in the acpi descs. Any subsequent
ACPI Machine Check Exception will trigger nfit handle mce() which
iterates over acpi descs and so a use-after-free will occur.
Moreover, if acpi nfit probe() returns 0 after installing a notify
handler for the NFIT device and without allocating the acpi desc
object and setting the NFIT device's driver data pointer, the
acpi desc object will be allocated by acpi nfit update notify()
and acpi nfit init() will be called to initialize it. Regardless
of whether or not acpi nfit init() fails in that case, the
acpi nfit shutdown() devm action is not added for the NFIT device
and acpi desc is never removed from the acpi descs list. If the
acpi desc object is freed subsequently on driver removal, any
subsequent ACPI MCE will lead to a use-after-free like in the
previous case.
To address the first issue mentioned above, make acpi nfit probe()
call acpi nfit shutdown() directly on acpi nfit init() failures and
to address the other one, add a remove callback to the driver and
make it call acpi nfit shutdown(). Also, since it is now possible to
pass NULL to acpi nfit shutdown() or the acpi desc object passed to it
may not have been initialized, add checks against NULL for acpi desc and
its nvdimm bus field to that function and make acpi nfit unregister()
clear the latter after unregistering the NVDIMM bus.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux