CVE-2026-64510

In the Linux kernel, the following vulnerability has been resolved:

ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup

If acpi_nfit_init() fails after adding the acpi_desc object to the

acpi_descs list, that object is never removed from that list because

the acpi_nfit_shutdown() devm action is not added for the NFIT device

in that case. Next, the acpi_nfit_init() failure causes

acpi_nfit_probe() to fail, the acpi_desc object is freed, and a

dangling pointer is left behind in the acpi_descs. Any subsequent

ACPI Machine Check Exception will trigger nfit_handle_mce() which

iterates over acpi_descs and so a use-after-free will occur.

Moreover, if acpi_nfit_probe() returns 0 after installing a notify

handler for the NFIT device and without allocating the acpi_desc

object and setting the NFIT device's driver data pointer, the

acpi_desc object will be allocated by acpi_nfit_update_notify()

and acpi_nfit_init() will be called to initialize it. Regardless

of whether or not acpi_nfit_init() fails in that case, the

acpi_nfit_shutdown() devm action is not added for the NFIT device

and acpi_desc is never removed from the acpi_descs list. If the

acpi_desc object is freed subsequently on driver removal, any

subsequent ACPI MCE will lead to a use-after-free like in the

previous case.

To address the first issue mentioned above, make acpi_nfit_probe()

call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and

to address the other one, add a remove callback to the driver and

make it call acpi_nfit_shutdown(). Also, since it is now possible to

pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it

may not have been initialized, add checks against NULL for acpi_desc and

its nvdimm_bus field to that function and make acpi_nfit_unregister()

clear the latter after unregistering the NVDIMM bus.