Junglewise Threat Intelligence

CVE-2026-31426: Linux kernel use-after-free in ACPI EC setup

CVE-2026-31426 · Severity: high · CVSS 7 · Published 2026-04-13

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's ACPI (Advanced Configuration and Power Interface) component could allow a local user to cause a system crash or potentially execute unauthorized code. The issue occurs on certain hardware platforms when the system fails to properly clean up internal data structures during startup. This can lead to a 'use-after-free' condition where the system attempts to access memory that has already been released, typically triggered when checking battery, thermal, or backlight status.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel ACPI EC driver (drivers/acpi/ec.c). When acpi_ec_setup() encounters a probe deferral (-EPROBE_DEFER) on reduced-hardware platforms, it fails to uninstall the address space handler before the associated acpi_ec structure is freed. This leaves a dangling pointer in ACPICA. A local, unprivileged user can trigger the UAF by performing sysfs reads that invoke AML (ACPI Machine Language) evaluations touching EC OpRegions (such as battery or thermal sensors). The vulnerability has been patched by ensuring ec_remove_handlers() is called during the error path of acpi_ec_setup().

Affected products

  • Linux Linux kernel 5.7 to 6.1.168, 6.2 to 6.6.131, 6.7 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11, 7.0-rc1 to 7.0-rc6

Timeline

  • 2026-03-25: other: Patch submitted by developer
  • 2026-04-11: patched: Patch committed to stable tree
  • 2026-04-13: disclosed: CVE published

References

Related threats