Description

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in two places Add boundary checks in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() to prevent out-of-bounds access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-24T17:17:22.663Z",
  "pubdate": "2026-09-24T17:17:22.663Z",
  "executiveSummary": "The Linux kernel's ACPICA (ACPI Component Architecture) subsystem contains two memory safety vulnerabilities identified as out-of-bounds access flaws.\nThe vulnerability resides within the ACPI parser, specifically in the functions acpi_ps_get_next_namestring() and acpi_ps_peek_opcode().\nThese flaws occur due to insufficient boundary validation during the processing of ACPI tables or bytecode, potentially leading to unauthorized memory access.\nAn attacker capable of providing a malformed ACPI table could trigger these out-of-bounds reads or writes, resulting in system instability (kernel panic) or potential information disclosure.\nWhile the specific exploitability of this flaw often requires local privilege escalation or hardware-level control to inject malicious ACPI tables, it represents a significant security risk to the kernel's integrity.\nThe vulnerability underscores the importance of strict input sanitization when processing complex data structures like ACPI bytecode within a highly privileged execution environment.",
  "technicalDetails": "The vulnerability is localized within the ACPICA component of the Linux kernel, specifically impacting the AML (ACPI Machine Language) parsing logic. The root cause of these vulnerabilities is the lack of bounds checking when traversing the input buffer provided to the ACPI parser.\nThe function acpi_ps_get_next_namestring() is responsible for parsing ACPI name strings from the instruction stream. Without adequate boundary checks, a specially crafted malicious ACPI table can cause the parser to read beyond the designated memory buffer limit, potentially accessing adjacent kernel memory. Similarly, acpi_ps_peek_opcode() suffers from a parallel flaw where it fails to verify if the current pointer position remains within the valid bounds of the AML opcode buffer before attempting to read the next opcode.\nIn a typical attack flow, a malicious entity would leverage an interface that allows for the modification or injection of ACPI tables, such as through UEFI firmware manipulation, physical access to the machine, or local interfaces (like /sys/firmware/acpi/tables/dynamic/ if exposed). Once the kernel consumes the malicious table, the ACPICA parser begins executing the corrupted bytecode. During the traversal of these structures, the vulnerable functions perform pointer arithmetic based on the length fields provided within the bytecode itself. If the length fields are malformed and exceed the actual buffer size, the internal pointer is incremented beyond the valid memory region.\nThe exploitation of these flaws leads to out-of-bounds memory access. Depending on the memory layout and the kernel's memory protections, this can lead to two primary outcomes: an immediate system crash due to a segmentation fault or a page fault when accessing non-mapped memory, or, in more severe cases, the leakage of sensitive kernel memory content back to the caller if the accessed data is subsequently processed or logged. Because the ACPICA subsystem operates at a high privilege level within the kernel, such memory access vulnerabilities can be leveraged to bypass kernel security boundaries or to facilitate further exploitation through kernel memory corruption.\nThe remediation involves the introduction of explicit bounds checking at the point of access in both affected functions to ensure the pointer arithmetic strictly adheres to the allocated buffer constraints."
}