CyberSecBulletin
CVE-2026-64510NVD status: Analyzed

Linux: Missing Release of Memory after Effective Lifetime

Published Updated By the CyberSecBulletin desk

CVE-2026-64510 is a high-severity missing release of memory after effective lifetime vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions ee82078e776ae31266cc70fdf62ac17c3c6f100a, 6ff054cc02a763914773b026cacb429e5fbf64fa, b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to ee82078e776ae31266cc70fdf62ac17c3c6f100a or 6ff054cc02a763914773b026cacb429e5fbf64fa or b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4 or c127dbd832bd4b9aef8a749d9f491b74042f9b47, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxa61fe6f7902ecaa89d5e6c709490fc4324927134 up to, but not including, ee82078e776ae31266cc70fdf62ac17c3c6f100a; a61fe6f7902ecaa89d5e6c709490fc4324927134 up to, but not including, 6ff054cc02a763914773b026cacb429e5fbf64fa; a61fe6f7902ecaa89d5e6c709490fc4324927134 up to, but not including, b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4; a61fe6f7902ecaa89d5e6c709490fc4324927134 up to, but not including, c127dbd832bd4b9aef8a749d9f491b74042f9b47; a61fe6f7902ecaa89d5e6c709490fc4324927134 up to, but not including, df7c92216a1583a76cb0cbf2f21cd68870609b05; a61fe6f7902ecaa89d5e6c709490fc4324927134 up to, but not including, 3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa; a61fe6f7902ecaa89d5e6c709490fc4324927134 up to, but not including, 7d69235bdc581a4346e9bcd6a8bea37d3e1abd25; a61fe6f7902ecaa89d5e6c709490fc4324927134 up to, but not including, 38bf27511ef41bffebd157ec3eba41fc89ba59cd; and 1 more rangesee82078e776ae31266cc70fdf62ac17c3c6f100a, 6ff054cc02a763914773b026cacb429e5fbf64fa, b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4, c127dbd832bd4b9aef8a749d9f491b74042f9b47, df7c92216a1583a76cb0cbf2f21cd68870609b05, 3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa
LinuxLinux Kernel4.6 up to, but not including, 5.10.261; 5.11 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.97; 6.13 up to, but not including, 6.18.40; 6.19 up to, but not including, 7.1.45.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdown() devm action is not added for the NFIT device in that case. Next, the acpi_nfit_init() failure causes acpi_nfit_probe() to fail, the acpi_desc object is freed, and a dangling pointer is left behind in the acpi_descs. Any subsequent ACPI Machine Check Exception will trigger nfit_handle_mce() which iterates over acpi_descs and so a use-after-free will occur. Moreover, if acpi_nfit_probe() returns 0 after installing a notify handler for the NFIT device and without allocating the acpi_desc object and setting the NFIT device's driver data pointer, the acpi_desc object will be allocated by acpi_nfit_update_notify() and acpi_nfit_init() will be called to initialize it. Regardless of whether or not acpi_nfit_init() fails in that case, the acpi_nfit_shutdown() devm action is not added for the NFIT device and acpi_desc is never removed from the acpi_descs list. If the acpi_desc object is freed subsequently on driver removal, any subsequent ACPI MCE will lead to a use-after-free like in the previous case. To address the first issue mentioned above, make acpi_nfit_probe() call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and to address the other one, add a remove callback to the driver and make it call acpi_nfit_shutdown(). Also, since it is now possible to pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it may not have been initialized, add checks against NULL for acpi_desc and its nvdimm_bus field to that function and make acpi_nfit_unregister() clear the latter after unregistering the NVDIMM bus.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

How developers prevent this class of flaw

  • Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone. For example, glibc in Linux provides protection against free of invalid pointers. When using Xcode to target OS X or iOS, enable automatic reference counting (ARC). To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std
  • Use an abstraction library to abstract away risky APIs. Not a complete solution.
  • Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

More Missing Release of Memory after Effective Lifetime vulnerabilities (CWE-401)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Missing Release of Memory after Effective Lifetime vulnerabilities

Spotted an error? Tell us.