Description

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-24T17:17:23.463Z",
  "pubdate": "2026-09-24T17:17:23.463Z",
  "executiveSummary": "This vulnerability involves an integer overflow condition within the ACPI Component Architecture (ACPICA) subsystem of the Linux kernel, specifically within the acpi_ex_opcode_3A_1T_1R() function.\nThe vulnerability occurs due to inadequate validation of input parameters during the calculation of truncation lengths, specifically when handling the Index and Length arguments.\nAn attacker capable of influencing ACPI tables or firmware-provided data can trigger an integer overflow, which leads to a negative value being passed to the memcpy() function as a size parameter.\nThe primary impact of this flaw includes potential memory corruption, kernel crashes (denial of service), or potential arbitrary memory access, depending on the memory layout and surrounding data structures.\nThe vulnerability affects any system utilizing the Linux kernel with the integrated ACPICA implementation, requiring the attacker to have sufficient privilege or system access to inject or modify ACPI instructions processed by the kernel.",
  "technicalDetails": "The vulnerability is located in the acpi_ex_opcode_3A_1T_1R() function within the ACPICA subsystem. This function handles specific ACPI opcodes that require three arguments, one target, and one result (3A_1T_1R).\nThe root cause is a lack of bounds checking for the 'Index' and 'Length' parameters used in memory operation logic. During the calculation of the truncation length for a data buffer, the expression (Index + Length) is computed without verifying if the result exceeds the maximum representable value for the variable type, leading to an integer overflow.\nWhen an overflow occurs, the resulting calculation can wrap around to a very small or negative integer. Because the subsequent memory operation (typically a memcpy() call) treats the size parameter as an unsigned type, this negative value is interpreted as a massive unsigned integer (e.g., 0xFFFFFFFFFFFFFFFF if signed -1 is cast to size_t).\nIn the context of the Linux kernel's memory management, passing an oversized or invalid length to memcpy() results in an out-of-bounds write or read operation. This overwrites adjacent kernel memory structures, leading to heap corruption or the corruption of internal kernel data objects.\nThe exploitation flow initiates when the kernel interprets malformed ACPI bytecode. An attacker can supply a malicious ACPI table (often through firmware modification or via interfaces that allow userspace to provide custom tables, if permitted by system configuration) to trigger the vulnerable opcode. When the interpreter executes acpi_ex_opcode_3A_1T_1R(), the integer overflow occurs, and the resulting incorrect size parameter is passed to the kernel's memory copy primitive.\nThis vulnerability does not require network access, as it is primarily triggered through local firmware data or malicious ACPI configurations. However, it demands the ability to influence the data structures parsed by the ACPI interpreter. The primary post-exploitation impact is a kernel panic resulting in system instability or, in more complex scenarios, the potential to overwrite control flow data if the memory corruption is leveraged to redirect execution."
}