Skip to main content

Linux Kernel CVE-2026-64183

| EUVDEUVD-2026-45868 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-19 Linux GHSA-wmr2-4wg6-fwrh
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Elevated AC:H reflects the specific prerequisite of EFI PRM-capable firmware; otherwise local, low-privilege, availability-only impact matches the original vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 11, 2026 - 23:12 vuln.today
CVSS changed
Aug 11, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:41 nvd
MEDIUM 5.5
CVE Published
Jul 19, 2026 - 15:41 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

efi: Allocate runtime workqueue before ACPI init

Since commit

5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers")

ACPI PRM calls are delegated to a workqueue which runs in a kernel thread, making it easier to detect and mitigate faulting memory accesses performed by the firmware.

Rafael reports that such PRM accesses may occur before efisubsys_init() executes, which is where the workqueue is allocated, leading to NULL pointer dereferences. Since acpi_init() [which triggers the early PRM accesses] executes as a subsys_initcall() as well, and has its own dependencies that may be sensitive to initcall ordering, deferring acpi_init() is not an option.

So instead, split off the workqueue allocation into its own postcore initcall, as this is the only missing piece to allow EFI runtime calls to be made. This ensures that EFI runtime call (including PRM calls) are accessible to all code running at subsys_initcall() level.

AnalysisAI

NULL pointer dereference in the Linux kernel's EFI runtime subsystem crashes affected systems when ACPI Platform Runtime Mechanism (PRM) handlers are invoked during early boot before the EFI runtime workqueue has been allocated. Systems with EFI PRM-capable firmware running unpatched kernels between the introduction of commit 5894cf571e14 and the respective stable-branch fixes are affected. No public exploit or CISA KEV listing exists; the vulnerability manifests as a kernel panic during initialization on susceptible hardware, resulting in a denial of service.

Technical ContextAI

The Linux kernel's ACPI PRM (Platform Runtime Mechanism) subsystem, since commit 5894cf571e14 ('acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers'), delegates PRM handler invocations to an EFI runtime workqueue running in a kernel thread. This workqueue was previously allocated only inside efisubsys_init(), which is a subsys_initcall(). Because acpi_init() is also a subsys_initcall() with its own dependency chain, PRM calls initiated through ACPI init could fire before the workqueue pointer is populated, resulting in a NULL pointer dereference (CWE-476). The root cause is an initcall ordering race between efisubsys_init() and acpi_init() - both at the same initcall level. The fix splits workqueue allocation into a dedicated postcore_initcall so it is ready before any subsys_initcall consumer. CPE cpe:2.3:a:linux:linux identifies the affected product across all architectures running vulnerable kernel versions.

RemediationAI

The primary fix is upgrading to a patched stable kernel release: 6.6.142 or later for the 6.6 LTS branch, 6.12.92 or later for the 6.12 branch, 6.18.34 or later for the 6.18 branch, 7.0.11 or later for the 7.0 branch, or any 7.1 release containing commit 13c6da02e767152c9ac4330962247a5e47011035. Commit references are available at https://git.kernel.org/stable/c/29cd94e678fcb3c4fd0f359deeac6d61334323fc and related links in the references. Ubuntu users should consult https://ubuntu.com/security/notices/USN-8593-1 for packaged updates. As a compensating control where patching is not immediately possible, disabling EFI PRM support at boot (if the firmware and kernel build allow) eliminates the vulnerable code path; however, this may disable firmware-level platform management features and should be tested for side effects. Systems without EFI PRM-capable firmware (including most virtual machine environments) are not affected and require no action.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Micro 6.2 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-64183 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy