Description

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() Fix use-after-free issue in acpi_ds_terminate_control_method() by clearing references to method locals and arguments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-24T17:17:23.957Z",
  "pubdate": "2026-09-24T17:17:23.957Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Linux kernel's ACPICA (ACPI Component Architecture) subsystem, specifically residing in the acpi_ds_terminate_control_method() function.\nThe flaw occurs due to improper management of object references when terminating control methods, specifically failing to clear references to local variables and method arguments.\nThis vulnerability could allow a local attacker with sufficient privileges to trigger memory corruption, potentially leading to kernel panics, denial-of-service conditions, or arbitrary code execution within the kernel context.\nSuccessful exploitation requires the ability to execute ACPI methods, typically achievable by a user with root or equivalent privileges capable of interacting with ACPI interfaces.\nThe risk is categorized as high due to the potential for memory corruption in a critical kernel subsystem that handles platform-specific firmware communication.",
  "technicalDetails": "The vulnerability resides within the ACPICA interpreter's handling of control method termination. The acpi_ds_terminate_control_method() function is responsible for cleaning up the execution environment after an ACPI control method completes execution.\nThe root cause is an insufficient cleanup process for objects stored within the method's local and argument stacks. When a control method terminates, the interpreter fails to properly nullify or decrement the reference counts for these objects. Consequently, if these objects are accessed or freed again after the method termination, a use-after-free scenario occurs.\nIn the ACPI subsystem, control methods operate within a managed object stack. Each method maintains local descriptors and arguments that are managed via reference counting. The vulnerability implies that pointers to these heap-allocated ACPI objects persist in the execution state beyond the lifetime of the objects themselves. An attacker can influence the execution flow of specific ACPI tables (DSDT/SSDT) to invoke methods that trigger this dangling pointer condition.\nThe attack flow proceeds as follows: 1) The attacker loads a malicious or crafted ACPI table that contains specific control methods designed to manipulate reference counts. 2) The attacker triggers the execution of these methods. 3) Upon reaching the termination phase, acpi_ds_terminate_control_method() fails to clear the stack references. 4) The kernel subsequently performs a memory management operation or attempts to re-reference the freed object, leading to a kernel-mode use-after-free access.\nBecause the Linux kernel uses these objects to interpret ACPI bytecode, an attacker could potentially manipulate the object heap to overlap the freed memory with attacker-controlled data. This could lead to hijacking kernel execution pointers or corrupting kernel data structures. Exploitation generally requires local access and the ability to load or interface with ACPI firmware modules. The lack of proper nullification effectively leaves the kernel in an inconsistent memory state where stale pointers remain reachable by subsequent ACPI operations, creating a classic UAF exploitation primitive within the interpreter's virtual machine environment."
}