Executive brief
The Linux kernel's ACPI Platform Firmware Runtime Update driver contains a stack buffer overflow vulnerability in firmware capability detection. Malicious or faulty firmware can trigger the overflow, allowing local attackers with firmware-level access to corrupt kernel memory and potentially achieve privilege escalation or denial of service on systems with affected ACPI implementations.
Technical details
The vulnerability is a stack-based buffer overflow in the query_capability() function of drivers/acpi/pfr_update.c. The function uses memcpy() to copy four ACPI buffer objects into fixed-size 16-byte destination fields (code_type, drv_type, platform_id, oem_id) within a stack-allocated struct pfru_update_cap_info, without validating that the firmware-supplied buffer.length does not exceed 16 bytes. If firmware returns buffers larger than 16 bytes, memcpy() writes past the destination array by up to 44+ bytes into adjacent stack memory. The vulnerable code path is reached through the pfru_ioctl() interface. The fix introduces input validation to check buffer lengths against destination sizes before copying, and returns -EINVAL if firmware supplies oversized buffers. Patches are available in Linux kernel stable branches from 5.x onwards.
Affected products
- Linux Linux kernel 5.0 and later
Timeline
- 2026-09-11: disclosed
- 2026-08-15: patched: Fix commit ced45be0 authored by Anirudh Prasad