Skip to main content

Linux Kernel CVE-2026-64182

| EUVDEUVD-2026-45867 MEDIUM
2026-07-19 Linux GHSA-pmqf-jjx9-qv6f
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only trigger via kernel poison accounting paths requiring low-privilege local access; no confidentiality or integrity impact; availability impact through reference count exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 11, 2026 - 23:12 vuln.today
CVSS changed
Aug 11, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drivers/base/memory: fix memory block reference leak in poison accounting

memblk_nr_poison_inc() and memblk_nr_poison_sub() look up a memory block via find_memory_block_by_id(), which acquires a reference to the memory block device.

Both helpers use the returned memory block without dropping that reference, leaking the device reference on each successful lookup. Drop the reference after updating nr_hwpoison.

AnalysisAI

Reference count leaking in the Linux kernel's hardware memory poison accounting subsystem (drivers/base/memory) causes memory block device objects to remain unreleased across repeated hardware memory error events, gradually degrading system stability. Affected kernels span multiple stable branches from introducing commit 5033091de814 through their respective fix commits, with patched releases available at 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and no active exploitation is recorded (EPSS 0.16%, 5th percentile); this is a slow-accumulating resource leak rather than an immediately weaponizable flaw.

Technical ContextAI

The Linux kernel's drivers/base/memory subsystem tracks hardware memory error (poison) counts through two helpers: memblk_nr_poison_inc() and memblk_nr_poison_sub(). Both internally call find_memory_block_by_id(), which performs a kobject/device lookup and implicitly calls get_device(), incrementing the struct memory_block reference count. Neither helper subsequently calls put_device() to release that reference after updating nr_hwpoison, meaning every successful lookup permanently inflates the reference count. Under sustained hardware corrected or uncorrected memory error conditions - common on ECC-equipped servers - these leaked references accumulate without bound, preventing the kernel from ever freeing those device objects. The root cause is a classic reference count management error analogous to CWE-401 (Missing Release of Memory after Effective Lifetime), though NVD lists CWE as N/A for this entry. CPE data identifies the affected product as cpe:2.3:a:linux:linux:* across multiple stable branches.

RemediationAI

Upgrade to a patched kernel version: Linux 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1. Upstream stable fix commits are published at https://git.kernel.org/stable/c/686b4283f82cd630fafd7ca9b03dfc080b3ec8fa (6.6.x), https://git.kernel.org/stable/c/8502e2c2d0633f99d94d22ae8dabc10caae1fc2a (6.12.x), https://git.kernel.org/stable/c/03a2cc1756a0570f887d624cd6c535ea0cbd4951 (6.18.x), https://git.kernel.org/stable/c/24840b3139d7415144b81e4f9f4c44670d15bed9 and https://git.kernel.org/stable/c/ce60d9452a0f2effa72fd20ea270c59ca691d455 (7.0.x). Ubuntu users should apply USN-8593-1. There is no effective kernel-configuration workaround for this flaw because the affected code path is exercised by hardware memory error events that cannot reasonably be suppressed without defeating the error-reporting subsystem entirely; disabling MCE (Machine Check Exception) handling as a workaround would introduce far greater risk than the leak itself. Given the slow-accumulating nature of the leak, patching can safely be deferred to the next standard maintenance window on systems not already experiencing frequent hardware memory errors.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Micro 6.2 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-64182 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy