Executive brief
The Linux kernel's ACPI RISC-V driver contains a loop logic error in code that processes PCI routing table entries for device dependencies. When error conditions occur during loop execution, the code incorrectly skips pointer updates, causing iteration to fail and some entries to be missed or processed incorrectly.
Technical details
The vulnerability is a control-flow logic error in the riscv_acpi_add_prt_dep() function within drivers/acpi/riscv/irq.c. The function iterates over a PCI routing table using a while loop; when certain error conditions (ACPI_FAILURE) are encountered, the code uses continue statements that bypass the critical entry pointer advancement, causing the loop to either skip entries or enter an infinite loop. The fix refactors the loop into a for-loop with explicit pointer advancement in the loop update clause and wraps boundary conditions in helper functions to ensure correct iteration regardless of error paths. This is a kernel-level bug affecting RISC-V ACPI initialization on affected systems.
Affected products
- Linux Linux kernel all RISC-V systems using ACPI (patched in commit 3a56321d0aceee2a0bd80d23366401c131ff8350)
Timeline
- 2026-07-09: other: Fix committed by Lorenzo Pieralisi
- 2026-09-17: disclosed