---
id: CVE-2026-64182
title: 'drivers/base/memory: fix memory block reference leak in poison accounting'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drivers/base/memory: fix memory block reference leak in poison accounting

  memblk_nr_poison_inc() and memblk_nr_poison_sub() look up a memory block
  via find_memory_bloc…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5033091de814ab4b5623faed2755f3064e19e2d2 <
    686b4283f82cd630fafd7ca9b03dfc080b3ec8fa
  - >-
    Linux >= 5033091de814ab4b5623faed2755f3064e19e2d2 <
    ce60d9452a0f2effa72fd20ea270c59ca691d455
  - >-
    Linux >= 5033091de814ab4b5623faed2755f3064e19e2d2 <
    24840b3139d7415144b81e4f9f4c44670d15bed9
  - >-
    Linux >= 5033091de814ab4b5623faed2755f3064e19e2d2 <
    8502e2c2d0633f99d94d22ae8dabc10caae1fc2a
  - >-
    Linux >= 5033091de814ab4b5623faed2755f3064e19e2d2 <
    03a2cc1756a0570f887d624cd6c535ea0cbd4951
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:31:29.998420Z'
published: '2026-07-19'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:28.411Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64182'
references:
  - url: 'https://git.kernel.org/stable/c/686b4283f82cd630fafd7ca9b03dfc080b3ec8fa'
  - url: 'https://git.kernel.org/stable/c/ce60d9452a0f2effa72fd20ea270c59ca691d455'
  - url: 'https://git.kernel.org/stable/c/24840b3139d7415144b81e4f9f4c44670d15bed9'
  - url: 'https://git.kernel.org/stable/c/8502e2c2d0633f99d94d22ae8dabc10caae1fc2a'
  - url: 'https://git.kernel.org/stable/c/03a2cc1756a0570f887d624cd6c535ea0cbd4951'
tags:
  - cve.org
epss: 0.00114
epssPercentile: 0.01487
ingestedAt: '2026-11-06T16:57:43.226Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drivers/base/memory: fix memory block reference leak in poison accounting

memblk_nr_poison_inc() and memblk_nr_poison_sub() look up a memory block
via find_memory_block_by_id(), which acquires a reference to the memory
block device.

Both helpers use the returned memory block without dropping that
reference, leaking the device reference on each successful lookup.  Drop
the reference after updating nr_hwpoison.

## Affected

- `Linux >= 5033091de814ab4b5623faed2755f3064e19e2d2 < 686b4283f82cd630fafd7ca9b03dfc080b3ec8fa`
- `Linux >= 5033091de814ab4b5623faed2755f3064e19e2d2 < ce60d9452a0f2effa72fd20ea270c59ca691d455`
- `Linux >= 5033091de814ab4b5623faed2755f3064e19e2d2 < 24840b3139d7415144b81e4f9f4c44670d15bed9`
- `Linux >= 5033091de814ab4b5623faed2755f3064e19e2d2 < 8502e2c2d0633f99d94d22ae8dabc10caae1fc2a`
- `Linux >= 5033091de814ab4b5623faed2755f3064e19e2d2 < 03a2cc1756a0570f887d624cd6c535ea0cbd4951`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.