PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64013 Linux CVE debrief

The Linux kernel was vulnerable to a GPE handler leak during ACPI button removal. A fix has been applied via commits 614cb8c and fe802511. This vulnerability could lead to a kernel crash if ACPI notify was triggered after driver removal. Linux kernel maintainers and users should review and apply patches to mitigate this issue. The vulnerability was publicly disclosed and affects Linux kernel versions. Maintainers and users must verify affected systems and apply patches.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-30
Advisory published
2026-07-19
Advisory updated
2026-07-30

Who should care

Linux kernel maintainers, users, security teams, and operators should be aware of this vulnerability and take steps to mitigate it. Affected systems should be identified and patched to prevent potential kernel crashes. Security teams must review compensating controls for exposed systems.

Technical summary

The Linux kernel had a vulnerability where the ACPI GPE handler was not properly removed during ACPI button removal. This could lead to a kernel crash if ACPI notify was triggered after driver removal. The issue was addressed via commits 614cb8c and fe802511. Defenders should focus on applying kernel updates and monitoring for unusual ACPI activity. The vulnerability was introduced due to a change in the ACPI notify handler type for ACPI buttons.

Defensive priority

Medium

Recommended defensive actions

  • Apply kernel updates
  • Monitor for unusual ACPI activity
  • Inventory Linux systems for exposure
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets
  • Confirm whether affected product deployments exist in managed environments

Evidence notes

Official CVE and NVD records confirm the vulnerability. Kernel.org references provide patch details. The Linux kernel was vulnerable to a GPE handler leak during ACPI button removal, which could lead to a kernel crash if ACPI notify was triggered after driver removal. This issue was addressed via commits 614cb8c and fe802511. Defenders should verify affected systems, review official advisories, and monitor for unusual ACPI activity. The vulnerability affects Linux kernel versions and was publicly disclosed.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64013 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64013

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64013 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64013

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/614cb8c26c5aa53196ee9b211b76ee618b147d32

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fe80251152fed5b185f795ef2cd9f7fe9c3162e0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.