Executive brief
The Linux kernel's LoongArch architecture implementation contains a buffer overflow in the ACPI package ID tracking array. On virtual machines with multiple CPU packages (sockets), the array can be overwritten with data from the ACPI PPTT table, potentially leading to kernel memory corruption and system instability or privilege escalation.
Technical details
The vulnerability is a stack/global buffer overflow in the acpi_package_ids[] array (arch/loongarch/kernel/acpi.c), which was sized statically to MAX_PACKAGES but insufficient for LoongArch virt machines that can have up to 256 sockets. When the kernel processes the PPTT (Processor Properties Topology Table) ACPI table during boot, it writes package IDs into this undersized array, causing out-of-bounds writes. The flaw affects Linux kernel versions 6.7 and later. The fix resizes the array to MAX(MAX_PACKAGES, KVM_MAX_VCPUS) to accommodate the maximum number of virtual CPUs. The vulnerability requires no user interaction; it is triggered during kernel boot on affected LoongArch virt machine configurations.
Affected products
- Linux Linux kernel 6.7 and later (LoongArch architecture)
Timeline
- 2026-09-16: disclosed
- 2026-08-17: patched: Fix committed upstream; stable backports released 2026-09-14