Executive brief
The Linux kernel's panasonic-laptop driver contains a heap buffer overflow in its ACPI BIOS data retrieval function. An attacker with local access to a system with affected Panasonic hardware could exploit this to corrupt kernel memory, potentially leading to privilege escalation or system crash. The vulnerability affects systems where the BIOS reports a specific off-by-one condition in its SINF package count.
Technical details
The vulnerability is a heap buffer overflow (array-index-out-of-bounds) in the acpi_pcc_retrieve_biosdata() function within platform/x86/panasonic-laptop.c. The root cause is an inconsistency between the bounds check and the subsequent sentinel write: the function rejects SINF packages only when pcc->num_sifr is strictly less than package.count, but then unconditionally writes a trailing sentinel at pcc->sinf[package.count]. Since pcc->sinf[] is allocated with exactly pcc->num_sifr elements, this write overflows when num_sifr equals package.count. This boundary condition occurs precisely when the probe() function's off-by-one workaround (which increments num_sifr to match a DSDT package count equal to SQTY+1) is active. The overflow is triggered locally during BIOS data retrieval on affected hardware and results in a 4-byte heap write past the allocated buffer. The fix skips the sentinel write when there is insufficient buffer space rather than tightening the rejection check, preserving compatibility with the existing workaround.
Affected products
- Linux Linux kernel affected versions containing platform/x86/panasonic-laptop.c prior to the fix
Timeline
- 2026-09-11: disclosed
- other: Vulnerability found via UBSan (array-index-out-of-bounds) on hardware where HKEY.SQTY returns 37 and HKEY.SINF() package has 38 elements