CVE-2026-64510: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup

In the Linux kernel, the following vulnerability has been resolved:

ACPI: NFIT: core: Fix acpinfitinit() error cleanup

If acpinfitinit() fails after adding the acpidesc object to the acpidescs list, that object is never removed from that list because the acpinfitshutdown() devm action is not added for the NFIT device in that case. Next, the acpinfitinit() failure causes acpinfitprobe() to fail, the acpidesc object is freed, and a dangling pointer is left behind in the acpidescs. Any subsequent ACPI Machine Check Exception will trigger nfithandlemce() which iterates over acpidescs and so a use-after-free will occur.

Moreover, if acpinfitprobe() returns 0 after installing a notify handler for the NFIT device and without allocating the acpidesc object and setting the NFIT device's driver data pointer, the acpidesc object will be allocated by acpinfitupdatenotify() and acpinfitinit() will be called to initialize it. Regardless of whether or not acpinfitinit() fails in that case, the acpinfitshutdown() devm action is not added for the NFIT device and acpidesc is never removed from the acpidescs list. If the acpidesc object is freed subsequently on driver removal, any subsequent ACPI MCE will lead to a use-after-free like in the previous case.

To address the first issue mentioned above, make acpinfitprobe() call acpinfitshutdown() directly on acpinfitinit() failures and to address the other one, add a remove callback to the driver and make it call acpinfitshutdown(). Also, since it is now possible to pass NULL to acpinfitshutdown() or the acpidesc object passed to it may not have been initialized, add checks against NULL for acpidesc and its nvdimmbus field to that function and make acpinfitunregister() clear the latter after unregistering the NVDIMM bus.