Description

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Prevent adding invalid references Prevent adding references for local, argument, and debug objects in acpi_ut_copy_simple_object().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-24T17:17:23.573Z",
  "pubdate": "2026-09-24T17:17:23.573Z",
  "executiveSummary": "The Linux kernel's ACPICA (ACPI Component Architecture) subsystem contains a vulnerability involving the improper handling of object references. Specifically, the function acpi_ut_copy_simple_object allows the creation of invalid references for local, argument, and debug objects.\nThis flaw represents a memory management vulnerability that could potentially be exploited to achieve unauthorized memory state manipulation or system instability.\nThe vulnerability resides within the ACPI table processing logic, which is integral to the initialization and power management functions of the Linux kernel. If exploited, an attacker capable of triggering specific ACPI evaluation paths might influence internal kernel object pointers, leading to a kernel panic or potentially more severe memory corruption scenarios.\nThe risk implication is high, as ACPI interfaces are exposed to userspace via various sysfs entries and device interfaces. Exploitation does not necessarily require network access but depends on the attacker's ability to influence the execution of ACPI Control Methods during system operation. Systems utilizing ACPICA are inherently affected, and remediation requires patching the object reference validation logic to ensure that only valid object types are subjected to reference counting operations.",
  "technicalDetails": "The vulnerability is rooted in the object reference counting mechanism within the ACPICA library, specifically inside acpi_ut_copy_simple_object(). This function is responsible for duplicating simple ACPI objects during the execution of ACPI control methods or internal data structure manipulation.\nIn the vulnerable implementation, the function fails to perform adequate type-checking or validation when processing object references. It incorrectly permits the addition of references for internal-only object types, namely 'local' objects (ACPI_TYPE_LOCAL_REFERENCE), 'argument' objects, and the 'debug' object (ACPI_TYPE_DEBUG_OBJECT).\nUnder normal operating conditions, these object types are transient or context-specific to the ACPI interpreter's internal stack and should not be aliased or copied via reference counting outside of their intended scope. By allowing a reference increment on these types, the kernel creates a dangling or mismanaged reference state. If the original object is destroyed or reallocated while the invalid reference persists, the ACPICA interpreter may encounter a Use-After-Free (UAF) condition or a null pointer dereference.\nThe exploitation flow begins with the trigger of a malicious or malformed ACPI control method. An attacker may influence this by interacting with ACPI-exposed interfaces (such as /sys/firmware/acpi/tables or device-specific control inputs) to force the ACPI interpreter to process objects that invoke acpi_ut_copy_simple_object() with the prohibited types.\nOnce the invalid reference is incremented, the kernel's reference counter for the associated memory structure becomes desynchronized from the actual lifecycle of the object. Subsequent kernel operations that rely on this object will then operate on stale, freed, or corrupted memory space. This can lead to arbitrary memory corruption if an attacker is able to groom the heap to allocate a malicious payload into the memory previously occupied by the improperly referenced object.\nThe vulnerability is specifically constrained to the interaction between the ACPICA engine and the kernel's memory management subsystem. No external authentication is required if the interface is accessible to a local user or if a compromised firmware/BIOS image is present. The technical impact is a compromise of the kernel's integrity, potentially allowing for arbitrary code execution or a Denial-of-Service (DoS) condition manifested as a kernel crash."
}