Description

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add validation for node in acpi_ns_build_normalized_path() Add validation for node in acpi_ns_build_normalized_path() to prevent use-after-free vulnerabilities.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-24T17:17:23.110Z",
  "pubdate": "2026-09-24T17:17:23.110Z",
  "executiveSummary": "A use-after-free vulnerability exists within the ACPICA component of the Linux kernel, specifically within the acpi_ns_build_normalized_path() function.\nThe vulnerability arises due to insufficient validation of the 'node' pointer, which may lead to memory safety violations if the kernel accesses a node that has already been deallocated.\nAn attacker capable of triggering specific ACPI namespace operations could potentially exploit this flaw to induce memory corruption.\nThe impact of successful exploitation includes potential system instability, kernel panics, or arbitrary code execution, depending on the attacker's ability to control the underlying memory state.\nThis vulnerability affects the Linux kernel's ACPICA subsystem, a critical component for power management and hardware configuration. The risk is significant, as it involves memory management errors within a privileged kernel context, potentially allowing local users to elevate privileges or disrupt system integrity.",
  "technicalDetails": "The vulnerability is located in the ACPICA (ACPI Component Architecture) implementation within the Linux kernel, specifically targeting the acpi_ns_build_normalized_path() function. This function is responsible for constructing a normalized string representation of an ACPI namespace node's path.\nThe root cause is a lack of object validation for the 'node' parameter passed to the function. In the context of the ACPI namespace, nodes may be deleted or deallocated during dynamic namespace updates or reconfiguration events. If the acpi_ns_build_normalized_path() function attempts to reference a node object that has been freed—without performing adequate checks to confirm the object's continued existence or validity—a use-after-free (UAF) condition occurs.\nThe attack flow typically begins with an actor triggering an operation that involves manipulating the ACPI namespace. By inducing a state where an ACPI node is deallocated (for example, through hotplug events or specific ACPI table updates), the attacker attempts to trigger a subsequent call to acpi_ns_build_normalized_path() that references the dangling pointer pointing to the recently freed memory location.\nBecause the function dereferences the 'node' pointer to traverse the namespace tree and build the path string, the kernel will attempt to read from or write to memory that is no longer strictly associated with the original object. This allows for the possibility of memory corruption if the memory allocator has reused the freed slot for another object, or a kernel oops if the memory region is unmapped or protected.\nThe vulnerability is technically significant because it circumvents standard object lifecycle management within the ACPI namespace manager. Exploitation does not necessarily require complex network access; rather, it requires local access to trigger the specific ACPI subsystem state transitions. An attacker who can influence ACPI namespace mutations may gain a primitives path for controlled memory read/write access. This effectively undermines the kernel's memory safety guarantees, potentially leading to privilege escalation if the attacker can influence kernel control flow or overwrite function pointers located in the reused memory segment. The fix involves adding explicit validation checks to ensure that the node structure is valid and hasn't been subject to premature deallocation before accessing its members during the path normalization process."
}