Expired Pointer Dereference Affecting kernel-debug-devel-matched package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CENTOS10-KERNELDEBUGDEVELMATCHED-18471084
- published31 Jul 2026
- disclosed25 Jul 2026
Introduced: 25 Jul 2026
NewCVE-2026-64510 (opens in a new tab)How to fix?
There is no fixed version for Centos:10 kernel-debug-devel-matched.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-debug-devel-matched package and not the kernel-debug-devel-matched package as distributed by Centos.
See How to fix? for Centos:10 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdown() devm action is not added for the NFIT device in that case. Next, the acpi_nfit_init() failure causes acpi_nfit_probe() to fail, the acpi_desc object is freed, and a dangling pointer is left behind in the acpi_descs. Any subsequent ACPI Machine Check Exception will trigger nfit_handle_mce() which iterates over acpi_descs and so a use-after-free will occur.
Moreover, if acpi_nfit_probe() returns 0 after installing a notify handler for the NFIT device and without allocating the acpi_desc object and setting the NFIT device's driver data pointer, the acpi_desc object will be allocated by acpi_nfit_update_notify() and acpi_nfit_init() will be called to initialize it. Regardless of whether or not acpi_nfit_init() fails in that case, the acpi_nfit_shutdown() devm action is not added for the NFIT device and acpi_desc is never removed from the acpi_descs list. If the acpi_desc object is freed subsequently on driver removal, any subsequent ACPI MCE will lead to a use-after-free like in the previous case.
To address the first issue mentioned above, make acpi_nfit_probe() call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and to address the other one, add a remove callback to the driver and make it call acpi_nfit_shutdown(). Also, since it is now possible to pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it may not have been initialized, add checks against NULL for acpi_desc and its nvdimm_bus field to that function and make acpi_nfit_unregister() clear the latter after unregistering the NVDIMM bus.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2507073
- https://access.redhat.com/security/cve/CVE-2026-64510
- https://git.kernel.org/stable/c/38bf27511ef41bffebd157ec3eba41fc89ba59cd
- https://git.kernel.org/stable/c/3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa
- https://git.kernel.org/stable/c/6ff054cc02a763914773b026cacb429e5fbf64fa
- https://git.kernel.org/stable/c/7d69235bdc581a4346e9bcd6a8bea37d3e1abd25
- https://git.kernel.org/stable/c/b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4
- https://git.kernel.org/stable/c/c127dbd832bd4b9aef8a749d9f491b74042f9b47
- https://git.kernel.org/stable/c/df7c92216a1583a76cb0cbf2f21cd68870609b05
- https://git.kernel.org/stable/c/ee82078e776ae31266cc70fdf62ac17c3c6f100a