CVE-2026-64183: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64183 is a NULL pointer dereference vulnerability in the Linux kernel's EFI runtime workqueue initialization, introduced by commit 5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers"). The flaw occurs when ACPI PRM (Platform Runtime Mechanism) handlers are invoked during acpi_init() before the EFI runtime workqueue is allocated in efisubsys_init(), causing a kernel crash. Affected kernel versions begin at 6.6 and extend through multiple stable branches prior to the fix. Fixed versions include 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. The EPSS score is 0.0 and the CVSS estimate is Medium (GitHub Advisory, Feedly).

The root cause is a NULL pointer dereference (CWE-476) resulting from an initcall ordering race in the Linux kernel's EFI and ACPI subsystems. Since both acpi_init() and efisubsys_init() execute as subsys_initcall() functions, ACPI PRM handlers may attempt to use the EFI runtime workqueue before it has been allocated, dereferencing a NULL pointer and triggering a kernel panic. The fix splits the workqueue allocation into its own postcore_initcall, ensuring it is available to all code running at subsys_initcall() level, including early ACPI PRM accesses. Deferring acpi_init() was not viable due to its own dependency ordering constraints (GitHub Advisory).

Successful triggering of this vulnerability results in a kernel NULL pointer dereference, causing an immediate system crash (kernel panic) and complete loss of availability for the affected host. The vulnerability is triggered during the kernel boot sequence on systems with ACPI PRM support and EFI runtime services, meaning it can render affected systems unbootable or unstable. There is no known confidentiality or integrity impact, and no evidence of lateral movement potential; the primary risk is a denial-of-service condition at the kernel level (GitHub Advisory, Feedly).

Update the Linux kernel to one of the following patched versions: 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1 (upstream). The fix is implemented by moving the EFI runtime workqueue allocation into its own postcore_initcall, ensuring it is available before any subsys_initcall() code (including acpi_init()) attempts to use it. Patches are available via the upstream stable kernel tree (GitHub Advisory). No configuration-based workaround is documented; upgrading to a patched kernel is the recommended remediation.