Skip to main content

Linux Kernel CVE-2026-64183

| EUVDEUVD-2026-45868 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-19 Linux GHSA-wmr2-4wg6-fwrh
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    System boots with EFI PRM-capable firmware
  2. Delivery
    acpi_init() fires as subsys_initcall
  3. Exploit
    ACPI triggers PRM handler via EFI runtime workqueue
  4. Execution
    Workqueue pointer is NULL (efisubsys_init not yet run)
  5. Persist
    Kernel dereferences NULL pointer
  6. Impact
    Kernel panic, system unavailable

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

This vulnerability requires three concurrent conditions: (1) the host system must have EFI PRM-capable firmware - purely virtual or non-UEFI environments are unaffected; (2) the running kernel must be in the affected version range post-commit 5894cf571e14 and pre-fix commits for the respective stable branch; (3) the ACPI PRM subsystem must attempt a PRM call during subsys_initcall initialization before efisubsys_init() executes. The triggering is non-interactive and occurs at boot time, not via runtime userspace action. Factors limiting exploitation: no userspace-controlled attack surface exists; the crash only occurs on hardware with PRM firmware support, which is not ubiquitous; virtual machines and containers share no exposure. CVSS PR:L reflects the local kernel context but does not imply an unprivileged user can reliably trigger this post-boot.
Impact

The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects local, low-privilege access with high availability impact. However, because the defect triggers during kernel initialization on EFI PRM-capable hardware, practical exploitability by an unprivileged local user is not straightforward - the crash occurs at boot time rather than in response to an arbitrary userspace syscall, which limits attacker-controlled triggering. EPSS is 0.16% (6th percentile), indicating the security community assigns very low likelihood of active exploitation. KEV status is absent, and no public exploit or POC is known at time of analysis. The real-world risk is therefore primarily to system availability on specific hardware (EFI PRM-capable firmware platforms), not a general privilege escalation or remote threat. Defenders should prioritize patching on bare-metal servers and embedded systems with UEFI PRM support over general-purpose virtual machines where EFI PRM is typically absent.
Exploit ScenarioDerived

A server with UEFI firmware implementing EFI PRM support boots an unpatched Linux kernel; during subsys_initcall processing, acpi_init() triggers a PRM handler invocation before efisubsys_init() has allocated the EFI runtime workqueue. The kernel dereferences the NULL workqueue pointer, triggers an oops or panic, and halts the system. No public exploit or POC exists; exploitation is not attacker-controlled under normal circumstances and is a hardware/firmware-dependent initialization race.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 11, 2026

NULL pointer dereference in the Linux kernel's EFI runtime subsystem crashes affected systems when ACPI Platform Runtime Mechanism (PRM) handlers are invoked during early boot before the EFI runtime workqueue has been allocated. Systems with EFI PRM-capable firmware running unpatched kernels between the introduction of commit 5894cf571e14 and the respective stable-branch fixes are affected. No public exploit or CISA KEV listing exists; the vulnerability manifests as a kernel panic during initialization on susceptible hardware, resulting in a denial of service.

RemediationAI

The primary fix is upgrading to a patched stable kernel release: 6.6.142 or later for the 6.6 LTS branch, 6.12.92 or later for the 6.12 branch, 6.18.34 or later for the 6.18 branch, 7.0.11 or later for the 7.0 branch, or any 7.1 release containing commit 13c6da02e767152c9ac4330962247a5e47011035. Commit references are available at https://git.kernel.org/stable/c/29cd94e678fcb3c4fd0f359deeac6d61334323fc and related links in the references. Ubuntu users should consult https://ubuntu.com/security/notices/USN-8593-1 for packaged updates. As a compensating control where patching is not immediately possible, disabling EFI PRM support at boot (if the firmware and kernel build allow) eliminates the vulnerable code path; however, this may disable firmware-level platform management features and should be tested for side effects. Systems without EFI PRM-capable firmware (including most virtual machine environments) are not affected and require no action.

Affected VersionsENISA

Linux patch: 0
Linux 5894cf571e14fb393a4d0a82538de032127b9d8b <29cd94e678fcb3c4fd0f359deeac6d61334323fc
Linux 5894cf571e14fb393a4d0a82538de032127b9d8b <e871549f7894ad4114b3dd53f241aa25a268ba8b
Linux 5894cf571e14fb393a4d0a82538de032127b9d8b <c32a1fbe0f9a48453a552bb315cc4f1e7a74084e
Linux 5894cf571e14fb393a4d0a82538de032127b9d8b <6996e954ae830f5b793ba6cf449885ca519dbdd2
Linux patch: 7.1
Linux patch: 7.0.11
Linux 5894cf571e14fb393a4d0a82538de032127b9d8b <13c6da02e767152c9ac4330962247a5e47011035
Linux patch: 6.6.142
Linux patch: 6.12.92
Linux patch: 6.18.34
Linux 6.6

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Linux kernel's ACPI PRM (Platform Runtime Mechanism) subsystem, since commit 5894cf571e14 ('acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers'), delegates PRM handler invocations to an EFI runtime workqueue running in a kernel thread. This workqueue was previously allocated only inside efisubsys_init(), which is a subsys_initcall(). Because acpi_init() is also a subsys_initcall() with its own dependency chain, PRM calls initiated through ACPI init could fire before the workqueue pointer is populated, resulting in a NULL pointer dereference (CWE-476). The root cause is an initcall ordering race between efisubsys_init() and acpi_init() - both at the same initcall level. The fix splits workqueue allocation into a dedicated postcore_initcall so it is ready before any subsys_initcall consumer. CPE cpe:2.3:a:linux:linux identifies the affected product across all architectures running vulnerable kernel versions.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.7 MEDIUM

Elevated AC:H reflects the specific prerequisite of EFI PRM-capable firmware; otherwise local, low-privilege, availability-only impact matches the original vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 11, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

efi: Allocate runtime workqueue before ACPI init

Since commit

5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers")

ACPI PRM calls are delegated to a workqueue which runs in a kernel thread, making it easier to detect and mitigate faulting memory accesses performed by the firmware.

Rafael reports that such PRM accesses may occur before efisubsys_init() executes, which is where the workqueue is allocated, leading to NULL pointer dereferences. Since acpi_init() [which triggers the early PRM accesses] executes as a subsys_initcall() as well, and has its own dependencies that may be sensitive to initcall ordering, deferring acpi_init() is not an option.

So instead, split off the workqueue allocation into its own postcore initcall, as this is the only missing piece to allow EFI runtime calls to be made. This ensures that EFI runtime call (including PRM calls) are accessible to all code running at subsys_initcall() level.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel deployed across virtually all cloud, server, and embedded environments
Social Media
1
Sightings
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Micro 6.2 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64183 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8593-1 ADVISORY https://vuldb.com/vuln/380303 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23066/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23068/ REF https://git.kernel.org/stable/c/13c6da02e767152c9ac4330962247a5e47011035 REF https://git.kernel.org/stable/c/29cd94e678fcb3c4fd0f359deeac6d61334323fc REF https://git.kernel.org/stable/c/6996e954ae830f5b793ba6cf449885ca519dbdd2 REF https://git.kernel.org/stable/c/c32a1fbe0f9a48453a552bb315cc4f1e7a74084e REF https://git.kernel.org/stable/c/e871549f7894ad4114b3dd53f241aa25a268ba8b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy