CVE-2026-64180

Source
https://cve.org/CVERecord?id=CVE-2026-64180
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64180.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64180
Downstream
Published
2026-07-19T15:41:03.751Z
Modified
2026-07-21T03:47:56.481462925Z
Summary
mm/memory_hotplug: fix memory block reference leak on remove
Details

In the Linux kernel, the following vulnerability has been resolved:

mm/memory_hotplug: fix memory block reference leak on remove

Patch series "mm: Fix memory block leaks and locking", v2.

This series fixes two memory block device reference leaks and one locking issue around the per-memory_block hwpoison counter.

This patch (of 2):

removememoryblocksandaltmaps() looks up each memory block with findmemoryblock(), which acquires a reference to the memory block device.

That reference is never dropped on this path, resulting in a leaked device reference when removing memory blocks and their altmaps. Drop the reference after retrieving mem->altmap and clearing mem->altmap, before removing the memory block device.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64180.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6b8f0798b85aa529011570369db985a788f3003f
Fixed
b8ab30c79fc00147125b9c39f928561d9dd13d06
Fixed
09ce923071e7852ece60d7368e05249bf32c7967
Fixed
df64c0d21c3f85f844b2f656333e43d97e6ffa74
Fixed
93866f55f7e292fe3d47d36c9efe5ee10213a06b

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64180.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.8.0
Fixed
6.12.92
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.34
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.11

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64180.json"