Executive brief
A vulnerability was identified in the Linux kernel's ACPI processor driver, which manages power and performance features for hardware. Under specific hardware configurations involving older Intel chipsets, the system could experience a kernel crash (NULL-pointer dereference) during hardware initialization. This would result in a system reboot or a complete denial of service, potentially impacting operational availability.
Technical details
A NULL-pointer dereference exists in the `acpi_processor_errata_piix4()` function within `drivers/acpi/acpi_processor.c`. The vulnerability occurs because a single device pointer (`dev`) is reused for sequential PCI device lookups (IDE and ISA devices). If the first lookup for the Intel 82371AB IDE device succeeds but the subsequent lookup for the ISA device fails, the pointer is overwritten with NULL. Subsequent calls to `dev_dbg()` using this pointer result in a kernel oops. An attacker with high privileges or a specific hardware environment could trigger this during boot or hardware re-scanning to cause a denial of service. The fix introduces independent pointers for each device lookup to ensure NULL values do not overwrite valid device references.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-01-12: other: Patch submitted by developer
- 2026-03-04: patched: Commits merged into stable branches
- 2026-05-08: disclosed: CVE assigned and published
References
- https://git.kernel.org/stable/c/01e8751b37a366b1ca561add0042f2ceb18c03bf
- https://git.kernel.org/stable/c/0398b641be2b66c2fc7e0163c606ef19372e7ad5
- https://git.kernel.org/stable/c/06724a60cfa9767ea90b0f5d3dfb5cdd251b64f5
- https://git.kernel.org/stable/c/29f60d3d06818d40118a30d663231f027ae87a05
- https://git.kernel.org/stable/c/ad86ac604f8391c0212a91412d4f764c7a85f254
- https://git.kernel.org/stable/c/b803811485ac0b2f774b6bf3abc8b999ba3b7033
- https://git.kernel.org/stable/c/f132e089fe89cadc2098991f0a3cb05c3f824ac6