Executive brief
The Linux kernel contains a vulnerability in ACPI processor module code that handles input/output APIC (IOAPIC) hotplug configuration. The vulnerable code fails to properly validate memory boundaries when parsing IOAPIC configuration tables, which could allow a local attacker to read beyond allocated memory or trigger kernel crashes by providing malformed ACPI tables.
Technical details
The vulnerability exists in the ACPI processor core driver's IOAPIC hotplug lookup functions (parse_madt_ioapic_entry and parse_mat_ioapic_entry in drivers/acpi/processor_core.c). The root cause is insufficient bounds checking when parsing MADT (Multiple APIC Description Table) and _MAT ACPI records. The code previously used a subtable's declared length to advance memory cursors without first validating that the declared length was contained within available buffer ranges or that required fixed structure fields were present. An attacker with local access who can provide malformed ACPI tables (via firmware or ACPI override mechanisms) could trigger an out-of-bounds memory read or cause a kernel panic. The fix introduces a madt_entry_is_valid() validation function to ensure complete generic headers exist, declared lengths are in bounds, and typed IOAPIC records contain the full fixed body before field access. Patches are available in Linux kernel stable branches.
Affected products
- Linux Linux kernel Affected versions include 2.6.x through 7.1.y; patched in upstream and stable branches
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-07-21: patched: Fix committed to mainline kernel by Rafael J. Wysocki
- 2026-07-15: other: Original fix authored by Pengpeng Hou