CVE-2026-64603: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64603 is a race condition vulnerability in the Linux kernel's platform/x86: intel-hid ACPI notify handler that can result in a NULL pointer dereference and kernel crash. The flaw was introduced after commit e2ffcda16290 ("ACPI: OSL: Allow Notify() handlers to run on all CPUs"), which enabled ACPI notify handlers to execute concurrently across multiple CPU cores. It affects Linux kernel versions from 6.8 up to (but not including) the patched commits, with fixes backported to stable branches 6.12.96, 6.18.39, and 7.1.4. The vulnerability was published on August 6, 2026, with an estimated CVSS severity of Medium and an EPSS score of 0.0 (Github Advisory, Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (related to CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) in the notify_handler() function of the intel-hid driver. On convertible and detachable devices (DMI chassis-type 31 and 32), the SW_TABLET_MODE input device is registered lazily on the first tablet-mode ACPI event via intel_hid_switches_setup(). When two ACPI notify events arrive simultaneously on different CPU cores, both threads can pass the !priv->switches guard check before either completes registration, causing the input device to be registered twice — producing a duplicate sysfs entry and a subsequent NULL pointer dereference. This is the same class of bug previously fixed in the sibling intel-vbtn driver by commit e075c3b13a0a, and is resolved here by protecting notify_handler() with a mutex (Github Advisory).

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (kernel panic) and denial of service. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Only systems running Linux kernel 6.8 or later on Intel-based convertible or detachable hardware (chassis-type 31 or 32) are affected, and exploitation requires local access to trigger concurrent tablet-mode ACPI events (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date. The vulnerability requires local access to a convertible or detachable device capable of generating concurrent ACPI tablet-mode events, significantly limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory, Feedly).

Apply the available kernel patches that introduce a mutex to protect notify_handler() against concurrent execution. Fixed versions include Linux kernel 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. The relevant upstream fix commits are a6402808e552, 86df6499dfd2, eace3b3e729d, and c085d82613d5. As a temporary workaround, disabling tablet-mode event handling on affected convertible/detachable systems may reduce exposure, though this will impact device functionality. Users should update to a patched kernel version provided by their Linux distribution as soon as possible (Github Advisory).