CVE-2026-64183

efi: Allocate runtime workqueue before ACPI init

MEDIUM
5.5
CVSS Score
Published: July 19, 2026 at 03:41 PM UTC
Updated: August 11, 2026 at 08:18 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: efi: Allocate runtime workqueue before ACPI init Since commit 5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers") ACPI PRM calls are delegated to a workqueue which runs in a kernel thread, making it easier to detect and mitigate faulting memory accesses performed by the firmware. Rafael reports that such PRM accesses may occur before efisubsys_init() executes, which is where the workqueue is allocated, leading to NULL pointer dereferences. Since acpi_init() [which triggers the early PRM accesses] executes as a subsys_initcall() as well, and has its own dependencies that may be sensitive to initcall ordering, deferring acpi_init() is not an option. So instead, split off the workqueue allocation into its own postcore initcall, as this is the only missing piece to allow EFI runtime calls to be made. This ensures that EFI runtime call (including PRM calls) are accessible to all code running at subsys_initcall() level.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.13 ≤ v < 6.18.346.19 ≤ v < 7.0.116.6 ≤ v < 6.12.926.6 ≤ v < 6.18.346.6 ≤ v < 6.6.1426.6 ≤ v < 7.0.116.6 ≤ v < 7.16.7 ≤ v < 6.12.925894cf571e14fb393a4d0a82538de032127b9d8b7.1 rc17.1 rc27.1 rc37.1 rc4
Vendor states this is fixed in 13c6da02e767152c9ac4330962247a5e47011035 (fixed)
Vendor states this is fixed in 29cd94e678fcb3c4fd0f359deeac6d61334323fc (fixed)
Vendor states this is fixed in 6996e954ae830f5b793ba6cf449885ca519dbdd2 (fixed)
Vendor states this is fixed in c32a1fbe0f9a48453a552bb315cc4f1e7a74084e (fixed)
Vendor states this is fixed in e871549f7894ad4114b3dd53f241aa25a268ba8b (fixed)
Vendor states this is fixed in 6.12.92 (unaffected)
Vendor states this is fixed in 6.18.34 (unaffected)
Vendor states this is fixed in 6.6 (unaffected)
Vendor states this is fixed in 6.6.142 (unaffected)
Vendor states this is fixed in 7.0.11 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card