Skip to main content

Linux Kernel CVE-2026-64227

| EUVDEUVD-2026-48635 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-24 Linux GHSA-pr66-3h83-6g86
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges needed to trigger driver override; only a kernel crash results, so C and I remain N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 13, 2026 - 12:08 vuln.today
CVSS changed
Aug 13, 2026 - 12:07 NVD
5.5 (MEDIUM)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:23 nvd
MEDIUM 5.5
CVE Published
Jul 24, 2026 - 15:23 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ACPI: driver: Check ACPI_COMPANION() against NULL during probe

Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), platform drivers that rely on the existence of a device's ACPI companion object should verify its presence.

Accordingly, add requisite ACPI_COMPANION() or ACPI_HANDLE() checks against NULL to 13 platform drivers handling core ACPI devices.

Also change the value returned by the ACPI thermal zone driver when the device's ACPI companion is not present to -ENODEV for consistency with the other drivers.

AnalysisAI

NULL pointer dereference in the Linux kernel ACPI platform driver subsystem crashes the kernel when 13 core ACPI drivers are force-matched to devices lacking an ACPI companion object. The root cause is the absence of ACPI_COMPANION() or ACPI_HANDLE() null-checks in affected drivers, combined with the kernel's device_match_driver_override() mechanism which can bypass normal device-ID matching. Impact is limited to local denial of service (kernel panic); no active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.17% (6th percentile), placing this firmly in the maintenance-fix rather than urgent-remediation category.

Technical ContextAI

The vulnerability is rooted in the Linux kernel's ACPI (Advanced Configuration and Power Interface) platform driver probe path. CWE-476 (NULL Pointer Dereference) describes the class: 13 platform drivers handling core ACPI devices dereference the ACPI companion object pointer without first verifying it is non-NULL. The kernel function device_match_driver_override() permits any platform driver to bind to any device regardless of its ID table, creating a path where an ACPI driver is probed against a device that was never enumerated through ACPI firmware. Without guarding dereferences with ACPI_COMPANION() or ACPI_HANDLE() checks, this results in a NULL pointer dereference and kernel panic. CPE data (cpe:2.3:a:linux:linux:*) confirms a wide historical exposure spanning all stable series from initial kernel history through the pre-patch stable releases.

RemediationAI

The primary remediation is upgrading to a patched kernel version: 6.6.145 or later for the 6.6 LTS series, 6.12.97 or later for the 6.12 LTS series, 6.18.40 or later for 6.18.x, 7.0.11 or later for 7.0.x, or 7.1 or later for mainline. Upstream stable commits are available for review at https://git.kernel.org/stable/c/f1e12d81f9cd250e722da01c7670b518d4181406, https://git.kernel.org/stable/c/a9451bf561232314755baf69a5916e0ac77f33fc, https://git.kernel.org/stable/c/34f4d0e4e5065237d15651df759a99e81b7f9f51, https://git.kernel.org/stable/c/612ddab8fce04394bd7aebe8e0f2599642e30859, and https://git.kernel.org/stable/c/e4865a56d013e86e46ea6acea15bb6eae01898ff. Ubuntu users should apply USN-8618-1 via standard package management. If an immediate kernel upgrade is not operationally feasible, a compensating control is to audit and restrict udev rules or kernel module parameters that leverage device_match_driver_override() for non-standard device-driver bindings; this limits the primary exploitation path but may break intentional hardware compatibility workarounds and should be tested carefully in staging before production deployment. Systems with standard, firmware-enumerated ACPI hardware not subject to driver overrides face negligible practical risk.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64227 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy