CVE-2026-64511 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, system administrators responsible for Linux kernel updates and security patches, and security teams should be aware of this vulnerability and take necessary actions to mitigate it. They should verify Linux kernel versions, apply patches, review system configurations, and monitor system logs for potential NFIT_NOTIFY_UC_MEMORY_ERROR notifications.

Why it matters

A NULL pointer dereference vulnerability was found in the Linux kernel's ACPI NFIT core. This issue occurs when the platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification on the NFIT device before the NFIT table is present, leading to a potential NULL pointer dereference in acpi_nfit_uc_error_notify().

• Verify Linux kernel versions and apply patches to address the vulnerability
• Review system configurations and ensure NFIT table presence before triggering notifications
• Monitor system logs for potential NFIT_NOTIFY_UC_MEMORY_ERROR notifications

Technical summary

The Linux kernel's ACPI NFIT core is vulnerable to a NULL pointer dereference. This occurs when the platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification on the NFIT device before the NFIT table is present. The vulnerability is addressed by adding a check against NULL in acpi_nfit_uc_error_notify(). Affected Linux kernel deployments require patching to mitigate the vulnerability. System administrators and developers should review system configurations and ensure NFIT table presence before triggering notifications.

Defensive priority

Verify Linux kernel versions and apply patches to address the vulnerability.

Recommended defensive actions

• Verify Linux kernel versions and apply patches to address the vulnerability
• Review system configurations and ensure NFIT table presence before triggering notifications
• Monitor system logs for potential NFIT_NOTIFY_UC_MEMORY_ERROR notifications
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including a description of the issue and potential impacts. However, additional information on affected versions and exploitation is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.