Description

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() Enhance buffer validation in acpi_ut_walk_aml_resources() to prevent buffer overflows.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-24T17:17:22.773Z",
  "pubdate": "2026-09-24T17:17:22.773Z",
  "executiveSummary": "A buffer overflow vulnerability exists within the ACPICA (ACPI Component Architecture) component of the Linux kernel, specifically within the acpi_ut_walk_aml_resources() function.\nThe vulnerability arises from insufficient validation of resource buffers during the parsing of ACPI Machine Language (AML).\nAn attacker capable of injecting malicious ACPI tables or triggering specific firmware-level resource requests could exploit this flaw to cause memory corruption.\nThe primary risk implications involve potential system instability, kernel panics, or the possibility of arbitrary code execution within the kernel context, depending on the attacker's ability to manipulate memory layout.\nExploitation requires the ability to influence the ACPI tables processed by the kernel, typically during the boot process or via hardware-level interactions.\nThis vulnerability impacts Linux kernel versions utilizing the affected ACPICA implementation, posing a significant security concern for systems relying on ACPI for hardware abstraction.",
  "technicalDetails": "The vulnerability resides in the acpi_ut_walk_aml_resources() function, which is responsible for traversing and validating ACPI resource descriptors contained within AML bytecodes. During the interpretation of these resources, the function performs iterative processing of variable-length resource tags.\nThe root cause is an inadequate bounds-checking mechanism when processing the length fields provided within the AML stream. If a malicious or malformed AML structure specifies a resource length that exceeds the actual allocated buffer size, the internal walker may advance its pointer past the legitimate memory boundaries.\nThe exploitation flow begins when the kernel parses ACPI tables, such as the Differentiated System Description Table (DSDT) or Secondary System Description Table (SSDT). An attacker with the ability to supply a custom ACPI table—often through firmware modification or an exploit in an early boot stage—can craft a malformed resource descriptor.\nWhen acpi_ut_walk_aml_resources() encounters this descriptor, the lack of rigorous size validation allows the function to read or write beyond the bounds of the destination buffer. In a write-overflow scenario, the function could overwrite adjacent kernel memory structures, such as function pointers or object headers, potentially redirecting execution flow.\nBecause this occurs within the ACPICA interpreter, the vulnerability effectively bridges the gap between hardware/firmware-provided data and the Linux kernel's execution context. Authentication requirements are typically low, as the system consumes these tables during the boot sequence or through hot-plug events. No complex network exposure is required for direct exploitation, as the vector is rooted in the platform's ACPI configuration.\nPost-exploitation impact includes the bypass of security boundaries established by the kernel's memory management. A successful overflow could result in privilege escalation if an attacker successfully overwrites kernel credentials or sensitive kernel data structures. The lack of bounds verification makes this a critical flaw in the processing of untrusted hardware descriptors, necessitated by the evolution of ACPICA to handle increasingly complex firmware-defined resource management."
}