Executive brief
A vulnerability in the Linux kernel's ACPI button driver can cause a system crash. The issue occurs when the driver for hardware buttons (like power or laptop lid buttons) is removed but fails to properly clean up its event handlers. If a button event occurs after this removal, the system may become unstable or stop functioning entirely.
Technical details
A notify handler leak exists in drivers/acpi/button.c due to a mismatch in handler types during driver removal. A previous update changed the ACPI notify handler type to ACPI_ALL_NOTIFY but failed to update the corresponding acpi_button_remove() function, which continued to attempt removal using ACPI_DEVICE_NOTIFY. This results in the handler remaining active after the driver is unloaded. If an ACPI notification is subsequently triggered for the device, the kernel attempts to execute code that is no longer present, leading to a crash. The issue also prevents successful re-probing of the device. Patches have been released for stable kernel branches including 6.15.y and 7.0.y.
Affected products
- Linux Linux 6.15 to 7.0.11
Timeline
- 2026-05-22: other: Patch authored
- 2026-07-19: disclosed: CVE published