Skip to main content

Linux Kernel CVE-2026-64180

| EUVDEUVD-2026-45865 MEDIUM
2026-07-19 Linux GHSA-8rwj-765p-2628
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.4 MEDIUM

Memory block removal requires root or hypervisor control, warranting PR:H over the vendor PR:L; no confidentiality or integrity impact applies.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 12, 2026 - 15:46 vuln.today
CVSS changed
Aug 12, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mm/memory_hotplug: fix memory block reference leak on remove

Patch series "mm: Fix memory block leaks and locking", v2.

This series fixes two memory block device reference leaks and one locking issue around the per-memory_block hwpoison counter.

This patch (of 2):

remove_memory_blocks_and_altmaps() looks up each memory block with find_memory_block(), which acquires a reference to the memory block device.

That reference is never dropped on this path, resulting in a leaked device reference when removing memory blocks and their altmaps. Drop the reference after retrieving mem->altmap and clearing mem->altmap, before removing the memory block device.

AnalysisAI

Memory hotplug removal in the Linux kernel leaks device references because find_memory_block() acquires a kobject reference inside remove_memory_blocks_and_altmaps() that is never released, allowing the reference count to accumulate unchecked across repeated memory block removal cycles. Systems with memory hotplug support - including virtual machines using ACPI memory balloon drivers and bare-metal servers with hot-pluggable DIMM slots - are affected across multiple stable kernel branches, with patches confirmed for 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and exploitation probability is extremely low (EPSS 0.16%), though the availability impact is rated high: leaked references accumulated over repeated hotplug cycles can eventually precipitate a kernel panic.

Technical ContextAI

The vulnerability resides in mm/memory_hotplug.c within the Linux kernel's memory hot-remove subsystem. remove_memory_blocks_and_altmaps() iterates over memory blocks slated for removal and calls find_memory_block() for each, which performs an implicit get_device() on the underlying memory block device object to return a reference-counted pointer. The corresponding put_device() call is missing before the device is unregistered, meaning each successful call to this path permanently increments the device's reference count without decrement. Over time this constitutes a kernel object reference leak - conceptually analogous to CWE-772 (Missing Release of Resource after Effective Lifetime), though the CWE field in the submission is marked N/A. The bug was introduced at commit 6b8f0798b85aa529011570369db985a788f3003f and affects all Linux builds carrying that commit until the respective stable-branch fix commits. CPE coverage is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, spanning the full Linux kernel package across distributions.

RemediationAI

The primary fix is upgrading to a patched stable kernel release: 6.12.92, 6.18.34, 7.0.11, or 7.1 depending on the branch in use. Stable commits are available at the kernel.org links cited above, and Ubuntu users should apply USN-8593-1 via standard package management (https://ubuntu.com/security/notices/USN-8593-1). For systems that cannot immediately patch, a targeted compensating control is to disable kernel memory hotplug at boot by setting memhp_default_state=offline in the kernel command line, which prevents memory block removal events from reaching the vulnerable code path; the trade-off is loss of dynamic memory scaling in virtualized environments and potential failure of ACPI memory hot-remove on physical hosts. Alternatively, restricting hypervisor-side memory balloon deflation operations eliminates the primary trigger in virtual machine deployments without altering guest kernel configuration, at the cost of reduced memory overcommit flexibility.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64180 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy