Executive brief
A vulnerability exists in the Linux kernel's ACPI processor driver that could lead to a system crash. This issue occurs when the system attempts to access hardware device information after that information has already been cleared from memory. An attacker with local access to the system could potentially exploit this to cause a denial-of-service, impacting operational availability.
Technical details
A use-after-free vulnerability exists in the acpi_processor_errata_piix4() function within the Linux kernel's ACPI processor driver (drivers/acpi/acpi_processor.c). The flaw was introduced by a previous fix for a NULL-pointer dereference, which resulted in device pointers being dereferenced after their reference counts were dropped via pci_dev_put(). A local attacker can trigger this condition to cause a kernel oops or system instability. The issue has been resolved by moving the debug message printing (which performed the invalid dereference) to occur before the device references are released. Patches are available for various stable kernel branches including 5.15, 6.1, 6.6, 6.12, 6.18, and 6.19.
Affected products
- Linux Linux Kernel 5.15.202 to 5.15.203, 6.1.165 to 6.1.167, 6.6.128 to 6.6.130, 6.12.75 to 6.12.78, 6.18.16 to 6.18.20, 6.19.6 to 6.19.10
Timeline
- 2026-03-17: patched: Initial patch authored by Rafael J. Wysocki
- 2026-04-03: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2
- https://git.kernel.org/stable/c/68408e8f9e366ad9850a66ac65cb569f13bf6cd4
- https://git.kernel.org/stable/c/8583f62259e1b315d5239371adfb36939cdab741
- https://git.kernel.org/stable/c/98473309a36acc271009b85e0bb53a4c0dddf5c2
- https://git.kernel.org/stable/c/bf504b229cb8d534eccbaeaa23eba34c05131e25
- https://git.kernel.org/stable/c/e0c470049344e9346fff79d7e2362212c216665e
- https://git.kernel.org/stable/c/edf4c2aaee08e8fd503fbae705c801e92a0b55d7