Executive brief
The Linux kernel's asus_atk0110 hardware monitoring driver contains a flaw in how it processes ACPI firmware packages from ASUS motherboards. When processing malformed firmware data with empty sub-packages, the driver can read memory beyond the allocated bounds, potentially allowing a local attacker to crash the system or extract sensitive kernel information if they can influence the firmware response or have local code execution.
Technical details
The vulnerability is an out-of-bounds read in the atk_ec_present() function within the asus_atk0110 hwmon driver. The function walks ACPI management group packages returned by the GGRP method and directly accesses the first element of sub-packages without verifying that the sub-package contains at least one element. In ACPICA, element arrays are allocated with exactly package.count entries, so a sub-package with count=0 causes an out-of-bounds read. The fix adds a package.count check before accessing elements[0], mirroring the defensive logic already present in the atk_debugfs_ggrp_open() function. The vulnerable code path is reachable if the system firmware is malformed or compromised, making this a local attack vector requiring no user interaction.
Affected products
- Linux Linux kernel multiple versions (2.6.11 and later, including stable branches 3.x–7.x)
Timeline
- 2026-08-28: disclosed: Public advisory published
- 2026-06-19: patched: Fix committed upstream (commit e2735b39f044bad7bf2017aef248935525bc0b97); backported to stable branches starting 2026-07-24