CVE-2026-64183 json
efi: Allocate runtime workqueue before ACPI init
published 2026-07-19 3 mo ago modified 2026-11-06 2 d ago also EUVD-2026-45868
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
efi: Allocate runtime workqueue before ACPI init
Since commit
5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers")
ACPI PRM calls are delegated to a workqueue which runs in a kernel thread, making it easier to detect and mitigate faulting memory accesses performed by the firmware.
Rafael reports that such PRM accesses may occur before efisubsys_init() executes, which is where the workqueue is allocated, leading to NULL pointer dereferences. Since acpi_init() [which triggers the early PRM accesses] executes as a subsys_initcall() as well, and has its own dependencies that may be sensitive to initcall ordering, deferring acpi_init() is not an option.
So instead, split off the workqueue allocation into its own postcore initcall, as this is the only missing piece to allow EFI runtime calls to be made. This ensures that EFI runtime call (including PRM calls) are accessible to all code running at subsys_initcall() level.
Patch / fix
- Linux Linux 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1
- linux Debian 13 6.12.94-1
- linux Debian 14 7.0.12-1
debian advisories DEBIAN-CVE-2026-64183
- linux Ubuntu 24.04 LTS 6.8.0-139.139
- linux Ubuntu 26.04 LTS 7.0.0-28.28
- linux-aws Ubuntu 24.04 LTS 6.8.0-1064.67
- linux-aws Ubuntu 26.04 LTS 7.0.0-1009.9
- linux-gcp Ubuntu 24.04 LTS 6.8.0-1067.75
- linux-gcp Ubuntu 26.04 LTS 7.0.0-1008.8
- linux-gke Ubuntu 24.04 LTS 6.8.0-1062.70
- linux-gke Ubuntu 26.04 LTS 7.0.0-1003.4
ubuntu advisories UBUNTU-CVE-2026-64183
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-rt Real Time Module 15 SP7 6.4.0-150700.7.72.1
- kernel-syms-rt Real Time Module 15 SP7 6.4.0-150700.7.72.1
- kernel-source-rt Real Time Module 15 SP7 6.4.0-150700.7.72.1
- kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.78.1
- kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.78.1
- kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.78.1
- kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.78.1
- kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.78.1
suse advisories SUSE-SU-2026:3810-1SUSE-SU-2026:3790-1SUSE-SU-2026:23244-1SUSE-SU-2026:23241-1SUSE-SU-2026:23194-1SUSE-SU-2026:23193-1
- kernel-rt openSUSE Leap 16.0 6.12.0-160000.37.1
- dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-64kb openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-syms openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-azure openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-source openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-default openSUSE Leap 16.0 6.12.0-160000.37.1
opensuse advisories openSUSE-SU-2026:21555-1
- git.kernel.org/stable/c/29cd94e678fcb3c4fd0f359deeac6d61334323fc commit
- git.kernel.org/stable/c/6996e954ae830f5b793ba6cf449885ca519dbdd2 commit
- git.kernel.org/stable/c/c32a1fbe0f9a48453a552bb315cc4f1e7a74084e commit
- git.kernel.org/stable/c/e871549f7894ad4114b3dd53f241aa25a268ba8b commit
- git.kernel.org/stable/c/13c6da02e767152c9ac4330962247a5e47011035 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-64183 updated cvss 5.5
kernel: efi: Allocate runtime workqueue before ACPI init
-
Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more Red Hat Enterprise Linux 10 kernelaffected: no fix available “Fix deferred”
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-selftests-internalnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 d ago
Exploit prediction
0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Linux Linux
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
- Technology feeds
References
-
git.kernel.org
/stable/c/29cd94e678fcb3c4fd0f359deeac6d61334323fc
patch
-
git.kernel.org
/stable/c/6996e954ae830f5b793ba6cf449885ca519dbdd2
patch
-
git.kernel.org
/stable/c/c32a1fbe0f9a48453a552bb315cc4f1e7a74084e
patch
-
git.kernel.org
/stable/c/e871549f7894ad4114b3dd53f241aa25a268ba8b
patch
-
git.kernel.org
/stable/c/13c6da02e767152c9ac4330962247a5e47011035
patch
Sources
- CVE List CVE-2026-64183
- NVD CVE-2026-64183
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.