CVE-2026-64511
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler for the NFIT device before checking the presence of the NFIT table. If that table is not there, 0 is returned without allocating the acpi_desc object and setting the driver data pointer of the NFIT device. If the platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification on the NFIT device at that point, acpi_nfit_uc_error_notify() will dereference a NULL pointer. Prevent that from occurring by adding an acpi_desc check against NULL to acpi_nfit_uc_error_notify().
Affected versions
Linux kernel versions
6.6
and later are affected. Fixed in
6.6.145,
6.12.96,
6.18.39,
7.1.4,
7.2-rc1
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-64511?
CVE-2026-64511 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.6 onward and has been patched in 6.6.145, 6.12.96, 6.18.39 and others. CVE-2026-64511 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64511?
Yes. CVE-2026-64511 has been patched. Fixed versions include 6.6.145, 6.12.96, 6.18.39 and others. If you are running Linux kernel 6.6 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64511 actively exploited?
No. CVE-2026-64511 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.