# CVE-2026-64510: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup

> A use-after-free in the Linux kernel ACPI NFIT driver allows attackers to trigger a crash or potentially execute code via ACPI Machine Check Exceptions.

- **Severity:** High 7.0 (`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 25 Jul 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-93419, BELL-CVE-2026-64510, DEBIAN-CVE-2026-64510, GHSA-7m99-cfrm-m9cq, ROOT-OS-DEBIAN-12-CVE-2026-64510, ROOT-OS-DEBIAN-13-CVE-2026-64510, ROOT-OS-UBUNTU-2204-CVE-2026-64510, UBUNTU-CVE-2026-64510

## What is CVE-2026-64510?

CVE-2026-64510 is a high-severity use after free vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup

If acpi_nfit_init() fails after adding the acpi_desc object to the
acpi_descs list, that object is never removed from that list because
the acpi_nfit_shutdown() devm action is not added for the NFIT device
in that case.  Next, the acpi_nfit_init() failure causes
acpi_nfit_probe() to fail, the acpi_desc object is freed, and a
dangling pointer is left behind in the acpi_descs.  Any subsequent
ACPI Machine Check Exception will trigger nfit_handle_mce() which
iterates over acpi_descs and so a use-after-free will occur.

Moreover, if acpi_nfit_probe() returns 0 after installing a notify
handler for the NFIT device and without allocating the acpi_desc
object and setting the NFIT device's driver data pointer, the
acpi_desc object will be allocated by acpi_nfit_update_notify()
and acpi_nfit_init() will be called to initialize it.  Regardless
of whether or not acpi_nfit_init() fails in that case, the
acpi_nfit_shutdown() devm action is not added for the NFIT device
and acpi_desc is never removed from the acpi_descs list.  If the
acpi_desc object is freed subsequently on driver removal, any
subsequent ACPI MCE will lead to a use-after-free like in the
previous case.

To address the first issue mentioned above, make acpi_nfit_probe()
call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and
to address the other one, add a remove callback to the driver and
make it call acpi_nfit_shutdown().  Also, since it is now possible to
pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it
may not have been initialized, add checks against NULL for acpi_desc and
its nvdimm_bus field to that function and make acpi_nfit_unregister()
clear the latter after unregistering the NVDIMM bus.

Weakness: CWE-416 (Use After Free)

## Which versions are affected by CVE-2026-64510?


## How do I fix CVE-2026-64510?

Apply the vendor's patch.

## Is CVE-2026-64510 being exploited?

There is no known exploitation of CVE-2026-64510 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-64510 and fix it if it is affected.

What it is: CVE-2026-64510 is a high-severity use after free vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-64510 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-64510/ (Markdown: https://insights.sbomify.com/CVE-2026-64510/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-64510
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64510
- OSV: https://osv.dev/vulnerability/CVE-2026-64510

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-64510/
Summaries are generated and may contain mistakes; the official description above is the record.