CVE-2026-64183: efi: Allocate runtime workqueue before ACPI init

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

efi: Allocate runtime workqueue before ACPI init

Since commit

  5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers")

ACPI PRM calls are delegated to a workqueue which runs in a kernel
thread, making it easier to detect and mitigate faulting memory accesses
performed by the firmware.

Rafael reports that such PRM accesses may occur before efisubsys_init()
executes, which is where the workqueue is allocated, leading to NULL
pointer dereferences. Since acpi_init() [which triggers the early PRM
accesses] executes as a subsys_initcall() as well, and has its own
dependencies that may be sensitive to initcall ordering, deferring
acpi_init() is not an option.

So instead, split off the workqueue allocation into its own postcore
initcall, as this is the only missing piece to allow EFI runtime calls
to be made. This ensures that EFI runtime call (including PRM calls) are
accessible to all code running at subsys_initcall() level.

The Linux kernel CVE team has assigned CVE-2026-64183 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6 with commit 5894cf571e14fb393a4d0a82538de032127b9d8b and fixed in 6.6.142 with commit 29cd94e678fcb3c4fd0f359deeac6d61334323fc
	Issue introduced in 6.6 with commit 5894cf571e14fb393a4d0a82538de032127b9d8b and fixed in 6.12.92 with commit 6996e954ae830f5b793ba6cf449885ca519dbdd2
	Issue introduced in 6.6 with commit 5894cf571e14fb393a4d0a82538de032127b9d8b and fixed in 6.18.34 with commit c32a1fbe0f9a48453a552bb315cc4f1e7a74084e
	Issue introduced in 6.6 with commit 5894cf571e14fb393a4d0a82538de032127b9d8b and fixed in 7.0.11 with commit e871549f7894ad4114b3dd53f241aa25a268ba8b
	Issue introduced in 6.6 with commit 5894cf571e14fb393a4d0a82538de032127b9d8b and fixed in 7.1 with commit 13c6da02e767152c9ac4330962247a5e47011035

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64183
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/firmware/efi/efi.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/29cd94e678fcb3c4fd0f359deeac6d61334323fc
	https://git.kernel.org/stable/c/6996e954ae830f5b793ba6cf449885ca519dbdd2
	https://git.kernel.org/stable/c/c32a1fbe0f9a48453a552bb315cc4f1e7a74084e
	https://git.kernel.org/stable/c/e871549f7894ad4114b3dd53f241aa25a268ba8b
	https://git.kernel.org/stable/c/13c6da02e767152c9ac4330962247a5e47011035