CVE-2026-64180: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64180 is a memory block device reference leak vulnerability in the Linux kernel's memory hotplug subsystem. The flaw exists in remove_memory_blocks_and_altmaps(), which calls find_memory_block() to look up memory blocks but never releases the acquired device references, resulting in a kernel resource leak. The vulnerability affects Linux kernel versions starting from 6.8 and is fixed in versions 6.12.92, 6.18.34, 7.0.11, and 7.1. It carries an estimated CVSS severity of Medium with an EPSS score of 0.0 (GitHub Advisory, Feedly).

The root cause is a missing put_device() (or equivalent reference drop) call in the remove_memory_blocks_and_altmaps() function within mm/memory_hotplug.c. When this function uses find_memory_block() to locate each memory block, it increments the device reference count, but the corresponding decrement is never performed on the removal code path. The fix ensures the reference is dropped after retrieving and clearing mem->altmap, but before the memory block device is removed. No CWE has been formally assigned, though the issue is consistent with CWE-772 (Missing Release of Resource after Effective Lifetime) (GitHub Advisory).

A local user with sufficient privileges to trigger memory hotplug removal operations can cause kernel memory exhaustion by accumulating unreleased device references over repeated memory block removal cycles. The primary impact is denial of service through kernel memory exhaustion; there is no evidence of confidentiality or integrity impact. The vulnerability does not enable remote code execution or lateral movement (Feedly).

Apply the upstream kernel patches that correct the reference leak in remove_memory_blocks_and_altmaps(). Fixed versions are Linux kernel 6.12.92, 6.18.34, 7.0.11, and 7.1. The specific fix commits are b8ab30c79fc0, 09ce923071e7, df64c0d21c3f, and 93866f55f7e2 for the respective stable branches. No configuration-based workaround is available; upgrading to a patched kernel version is the recommended remediation (GitHub Advisory).