Not yet scoredPublished Jul 25, 2026

CVE-2026-64511ACPI: NFIT: core: Fix possible NULL pointer dereference

Updated under an hour ago (Oct 27, 2026, 5:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler for the NFIT device before checking the presence of the NFIT table. If that table is not there, 0 is returned without allocating the acpi_desc object and setting the driver data pointer of the NFIT device. If the platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification on the NFIT device at that point, acpi_nfit_uc_error_notify() will dereference a NULL pointer. Prevent that from occurring by adding an acpi_desc check against NULL to acpi_nfit_uc_error_notify().

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9b311b7313d6c104dd4a2d43ab54536dce07f960 before a44343fe230aa48c74ef09830f3c5c90848b257e; 9b311b7313d6c104dd4a2d43ab54536dce07f960 builds before 3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6; from 9b311b7313d6c104dd4a2d43ab54536dce07f960 before 452945662fd8e9862a2d2043239c7ee1815d1ac4; from 9b311b7313d6c104dd4a2d43ab54536dce07f960 before 873576e585da5d0fc5debbab74eed565c0acea99; from 9b311b7313d6c104dd4a2d43ab54536dce07f960 before 027e128abb82788189d6d45b68e3e8e7329b67be	CNA record

References

References

https://git.kernel.org/stable/c/a44343fe230aa48c74ef09830f3c5c90848b257e
https://git.kernel.org/stable/c/3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6
https://git.kernel.org/stable/c/452945662fd8e9862a2d2043239c7ee1815d1ac4
https://git.kernel.org/stable/c/873576e585da5d0fc5debbab74eed565c0acea99
https://git.kernel.org/stable/c/027e128abb82788189d6d45b68e3e8e7329b67be

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.