CVE-2026-64182: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64182 is a memory block device reference leak vulnerability in the Linux kernel's drivers/base/memory subsystem, specifically in the hardware poison accounting functions. The functions memblk_nr_poison_inc() and memblk_nr_poison_sub() call find_memory_block_by_id(), which acquires a reference to a memory block device, but fail to release that reference after updating the nr_hwpoison counter, resulting in a kernel device reference leak on each successful lookup. The vulnerability was published on July 19, 2026, and affects Linux kernel versions starting from 6.2 up to (but not including) the patched stable releases (GitHub Advisory). The CVSS base score is currently 0.0 with a medium severity estimate (Feedly).

The root cause is a missing put_device() call (or equivalent reference decrement) after find_memory_block_by_id() returns a memory block device object with an incremented reference count (CWE-401: Missing Release of Memory after Effective Lifetime). Each invocation of memblk_nr_poison_inc() or memblk_nr_poison_sub() — triggered during hardware memory poisoning accounting — leaks one kernel device reference. Exploitation requires local access to trigger memory poisoning accounting operations, such as through hardware memory error injection or ECC error handling paths. No public proof-of-concept exploit code is known to exist (GitHub Advisory, Feedly).

Repeated triggering of the reference leak can gradually exhaust kernel memory resources, potentially causing system instability or an unresponsive state (denial of service). The vulnerability does not directly expose confidential data or allow privilege escalation, but sustained exploitation could degrade system availability on affected Linux hosts. The impact is limited to availability, with no known confidentiality or integrity consequences (Feedly, GitHub Advisory).

Patches have been backported to multiple stable Linux kernel branches. The fixed versions are: 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1 (mainline). Administrators should update to one of these patched kernel versions as soon as possible. No configuration-based workaround is available; upgrading the kernel is the only remediation (GitHub Advisory, Feedly).