CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mm/memory_hotplug: fix memory block reference leak on remove

Patch series "mm: Fix memory block leaks and locking", v2.

This series fixes two memory block device reference leaks and one locking
issue around the per-memory_block hwpoison counter.


This patch (of 2):

remove_memory_blocks_and_altmaps() looks up each memory block with
find_memory_block(), which acquires a reference to the memory block
device.

That reference is never dropped on this path, resulting in a leaked device
reference when removing memory blocks and their altmaps.  Drop the
reference after retrieving mem->altmap and clearing mem->altmap, before
removing the memory block device.

The Linux kernel CVE team has assigned CVE-2026-64180 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.8 with commit 6b8f0798b85aa529011570369db985a788f3003f and fixed in 6.12.92 with commit b8ab30c79fc00147125b9c39f928561d9dd13d06
	Issue introduced in 6.8 with commit 6b8f0798b85aa529011570369db985a788f3003f and fixed in 6.18.34 with commit 09ce923071e7852ece60d7368e05249bf32c7967
	Issue introduced in 6.8 with commit 6b8f0798b85aa529011570369db985a788f3003f and fixed in 7.0.11 with commit df64c0d21c3f85f844b2f656333e43d97e6ffa74
	Issue introduced in 6.8 with commit 6b8f0798b85aa529011570369db985a788f3003f and fixed in 7.1 with commit 93866f55f7e292fe3d47d36c9efe5ee10213a06b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64180
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	mm/memory_hotplug.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b8ab30c79fc00147125b9c39f928561d9dd13d06
	https://git.kernel.org/stable/c/09ce923071e7852ece60d7368e05249bf32c7967
	https://git.kernel.org/stable/c/df64c0d21c3f85f844b2f656333e43d97e6ffa74
	https://git.kernel.org/stable/c/93866f55f7e292fe3d47d36c9efe5ee10213a06b