Description

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in acpi_ps_get_next_field() Add boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-24T17:17:23.823Z",
  "pubdate": "2026-09-24T17:17:23.823Z",
  "executiveSummary": "This vulnerability involves an out-of-bounds access flaw within the ACPICA (ACPI Component Architecture) subsystem of the Linux kernel.\nThe issue resides in the acpi_ps_get_next_field() function, which fails to implement necessary boundary checks during the parsing of ACPI AML (ACPI Machine Language) field definitions.\nSuccessful exploitation could allow an attacker to trigger an out-of-bounds memory read or write, potentially leading to kernel-level information disclosure, denial-of-service via system instability (kernel panic), or theoretically, arbitrary code execution.\nThe vulnerability affects the Linux kernel's handling of ACPI tables, which are typically loaded by the firmware at boot time.\nWhile exploitation generally requires an attacker to provide a malicious or malformed ACPI table, the risk is significant as it affects the core kernel logic responsible for hardware abstraction and power management.\nNo specific authentication or network requirements are necessary if the attacker can influence the system's ACPI tables, such as via peripheral firmware or direct access to ACPI configuration interfaces.",
  "technicalDetails": "The root cause of this vulnerability is the absence of adequate bounds validation in the acpi_ps_get_next_field() function when processing field specifications within AML bytecodes. The function is designed to iterate through fields during the parsing of the ACPI namespace; however, it lacks checks to verify if the stream pointer has exceeded the predefined memory buffer limits designated for the field definition.\nIn the context of the ACPI parser, the kernel interprets AML, which is a pseudo-code language used to describe hardware configuration. If the stream pointer advances beyond the legitimate data buffer due to a maliciously crafted field length or offset, the parser performs operations on unintended memory locations.\nThe attack flow commences with the loading of a malformed ACPI table, often via the DSDT (Differentiated System Description Table) or SSDT (Secondary System Description Table). When the kernel's ACPICA subsystem initiates the parsing of this table, the flow of execution enters acpi_ps_get_next_field(). Because the function does not validate the offset against the remaining buffer size, an out-of-bounds read or write occurs depending on the subsequent operations performed on the retrieved field data.\nIf the out-of-bounds access involves a read operation, sensitive kernel memory could be leaked into the ACPICA parser's internal structures. If the operation is a write, it could overwrite adjacent kernel memory structures, potentially modifying kernel data pointers or function pointers, which could lead to privilege escalation or system hijacking. Given that the kernel executes these routines with highest privilege, any memory corruption in this context is critical.\nThis vulnerability is persistent across any Linux kernel version incorporating the affected ACPICA code. It is categorized as a memory safety error (specifically out-of-bounds access) because the logic fails to enforce constraints on pointers used during the decoding process of variable-length ACPI objects. The impact is exacerbated by the fact that the ACPI parser is an essential, high-complexity component that is historically prone to input-validation issues when processing complex and untrusted firmware-provided AML code."
}