Description
In the Linux kernel, the following vulnerability has been resolved:

drivers/base/memory: set mem->altmap after successful device registration

If __add_memory_block() fails at xa_store() (under memory pressure for
example), device_unregister() is called, which eventually triggers
memory_block_release() with mem->altmap still set, causing a
WARN_ON(mem->altmap). This was triggered by modifying virtio-mem driver.

Fix this by delaying the assignment of mem->altmap until after
__add_memory_block() has succeeded.
Published: 2026-07-24
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in the Linux kernel occurs in the memory block registration routine where the alternative memory map pointer (mem->altmap) is assigned before the completion of __add_memory_block(). When the addition fails—such as under memory pressure—the device is unregistered, and a cleanup routine later accesses mem->altmap while it is still set, triggering a WARN_ON. This results in a kernel warning but no known denial‑of‑service or code‑execution scenario was documented.

Affected Systems

All Linux kernel builds that include the memory block registration code, especially those that use the virtio‑mem driver, are affected. No specific kernel versions are listed; any kernel that contains the vulnerable code path before the patch commit is potentially impacted.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is less than 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the flaw could lead to kernel instability when memory pressure causes __add_memory_block() to fail, but no concrete exploit or crash scenario is documented. Consequently, the overall risk is considered low.

Generated by OpenCVE AI on August 4, 2026 at 14:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a release that includes the patch that delays the assignment of mem->altmap until __add_memory_block() succeeds.
  • If a kernel upgrade is not feasible, disable or avoid loading drivers that perform dynamic memory block registration, such as the virtio‑mem driver, until the issue is resolved.
  • Monitor kernel logs for WARN_ON(mem->altmap) entries to detect and investigate the failure condition early.

Generated by OpenCVE AI on August 4, 2026 at 14:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-668

Mon, 03 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-759

Wed, 29 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low


Sun, 26 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-759

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem->altmap after successful device registration If __add_memory_block() fails at xa_store() (under memory pressure for example), device_unregister() is called, which eventually triggers memory_block_release() with mem->altmap still set, causing a WARN_ON(mem->altmap). This was triggered by modifying virtio-mem driver. Fix this by delaying the assignment of mem->altmap until after __add_memory_block() has succeeded.
Title drivers/base/memory: set mem->altmap after successful device registration
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-24T15:29:59.891Z

Reserved: 2026-07-19T15:36:31.772Z

Link: CVE-2026-64244

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-24T16:16:53.803

Modified: 2026-07-30T15:00:27.343

Link: CVE-2026-64244

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-24T00:00:00Z

Links: CVE-2026-64244 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T15:00:14Z

Weaknesses
  • CWE-668

    Exposure of Resource to Wrong Sphere