Skip to main content

Linux Kernel EUVDEUVD-2026-48653

| CVE-2026-64244 MEDIUM
2026-07-24 Linux GHSA-837v-fg39-rfww
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects that reliable triggering requires induced memory pressure for xa_store() failure; no confidentiality or integrity impact exists per description.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 21:54 vuln.today
CVSS changed
Aug 17, 2026 - 19:37 NVD
5.5 (MEDIUM)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:29 nvd
MEDIUM 5.5
CVE Published
Jul 24, 2026 - 15:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drivers/base/memory: set mem->altmap after successful device registration

If __add_memory_block() fails at xa_store() (under memory pressure for example), device_unregister() is called, which eventually triggers memory_block_release() with mem->altmap still set, causing a WARN_ON(mem->altmap). This was triggered by modifying virtio-mem driver.

Fix this by delaying the assignment of mem->altmap until after __add_memory_block() has succeeded.

AnalysisAI

Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.

Technical ContextAI

The vulnerable code resides in drivers/base/memory within the Linux kernel's memory hotplug subsystem, specifically in __add_memory_block(). The function registers a new memory block using xa_store() against the kernel's XArray structure; if that allocation fails - a realistic outcome under memory pressure - the cleanup path calls device_unregister(). Prior to the fix, mem->altmap was assigned before confirming successful registration, so the memory_block_release() callback invoked during unregister encountered a non-NULL altmap and fired WARN_ON(mem->altmap). The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the Linux kernel broadly. No CWE was formally assigned, but the root cause maps to CWE-459 (Incomplete Cleanup) or CWE-703 (Improper Check or Handling of Exceptional Conditions): the resource pointer is assigned prematurely and not cleared before the error teardown path executes. The bug was surfaced via the virtio-mem driver, which uses memory hotplug to dynamically add and remove memory blocks in virtualized environments.

RemediationAI

Upgrade to a patched kernel version: 6.6.144, 6.12.95, 6.18.37, 7.0.14, 7.1.2, or 7.2-rc1, as appropriate for the deployed stable series. Fix commits are available at https://git.kernel.org/stable/c/802e113cf120df7208e4c7e604950a85e87120a8 (one branch), https://git.kernel.org/stable/c/22dc0d042f02ce82aa61422ea5f232628bfd9e9c, https://git.kernel.org/stable/c/6c25bf4e44a2b6a14332f952bba0974521f5b72d, https://git.kernel.org/stable/c/bc3dd82a0ffd488bb902f4c69c3d28fd4088d973, https://git.kernel.org/stable/c/059ac6252a63edf1cea79bf30bd860a8c264b62c, and https://git.kernel.org/stable/c/a2b8d7827f48ee54a686cb80e4a1d0ff954ec42a for the remaining branches. Distributions should be monitored for kernel updates backporting these commits. Where immediate kernel updates are not feasible, disabling virtio-mem device attachment or avoiding memory hotplug operations in memory-constrained environments reduces exposure to the failure path, though this limits dynamic memory ballooning capabilities in virtualized workloads.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

EUVD-2026-48653 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy