CVE-2026-97452 (GCVE-0-2026-97452)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:04 – Updated: 2026-09-25 05:10
VLAI
Title
ACPICA: Prevent adding invalid references
Summary
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Prevent adding invalid references Prevent adding references for local, argument, and debug objects in acpi_ut_copy_simple_object().
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e16d1e5fcb17dfc369e20095f8cf5e841101279e (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a6cd2fc2d5429a5b7d5a8b9ba0e6663e8ccbc9ba (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6e8c55e13a5e3a9f38921d62924f18ceba3330eb (git)
Affected: 0 , < 6.12.111 (semver)
Affected: 0 , < 6.18.53 (semver)
guessed Create a notification for this product.
Linux Linux Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/acpica/utcopy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e16d1e5fcb17dfc369e20095f8cf5e841101279e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a6cd2fc2d5429a5b7d5a8b9ba0e6663e8ccbc9ba",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6e8c55e13a5e3a9f38921d62924f18ceba3330eb",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.111",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.53",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/acpica/utcopy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Prevent adding invalid references\n\nPrevent adding references for local, argument, and debug objects\nin acpi_ut_copy_simple_object()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled AML is a CopyObject of a Package whose elements are Local/Arg/Debug references, carried in a DSDT/SSDT rather than a network message. The patched acpi_ut_copy_simple_object() is reached from acpi_ex_opcode_1A_1T_1R(AML_COPY_OBJECT_OP) during acpi_bus_init\u2192acpi_load_tables\u2192acpi_tb_load_namespace\u2192acpi_ns_load_table\u2192acpi_ns_execute_table.\nAC:L - acpi_ds_init_object_from_op() sets a Local/Arg reference.object to \u0026walk_state-\u003elocal_variables[i]/arguments[i]; after that method returns, acpi_ps_parse_aml() calls acpi_ds_delete_walk_state(). A later module-level CopyObject of the surviving package always UAF-reads that freed node in acpi_ut_add_reference(); the AML author sequences both sides with no race.\nPR:N - acpi_bus_init() calls acpi_load_tables() which runs module-level CopyObject via acpi_ns_execute_table() with no uid or capable() check; a DSDT/SSDT that stores Package(){Local0} from a nested method then CopyObject\u0027s it triggers the UAF at boot without a Linux account or configfs SSDT load.\nUI:N - acpi_ns_execute_table() evaluates the table\u0027s module-level AML, including the nested method that plants the Local/Arg refs and the subsequent CopyObject, during acpi_load_tables() at ordinary power-on; no mount, file-open, or other victim action is required.\nS:U - The UAF is of the kmalloc\u0027d struct acpi_walk_state (its local_variables/arguments pseudo-nodes) inside the host ACPICA interpreter after acpi_ds_delete_walk_state(); it does not cross a KVM/Xen, IOMMU, or sandbox boundary.\nC:H - acpi_ut_valid_internal_object() reads descriptor_type from the freed walk_state (the reported 1-byte KASAN UAF at the CopyObject copy). Reclaiming that slab as a fake ACPI_DESC_TYPE_OPERAND lets acpi_ut_update_object_reference walk attacker-chosen nested pointers, a UAF read primitive.\nI:H - If the freed walk_state is sprayed as a valid operand, acpi_ut_copy_simple_object()\u0027s acpi_ut_add_reference() calls acpi_ut_update_object_reference(REF_INCREMENT) on attacker-controlled type and nested pointers, a UAF write/refcount-increment primitive; memcpy also plants the dangling pointer into the dest copy.\nA:H - The KASAN report is a heap-use-after-free in acpi_ut_valid_internal_object() on the CopyObject path after acpi_ds_delete_walk_state(); using that dangling Local/Arg node pointer oopses/panics, and any UAF is Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:10:45.157Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e16d1e5fcb17dfc369e20095f8cf5e841101279e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6cd2fc2d5429a5b7d5a8b9ba0e6663e8ccbc9ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e8c55e13a5e3a9f38921d62924f18ceba3330eb"
        }
      ],
      "title": "ACPICA: Prevent adding invalid references",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97452",
    "datePublished": "2026-09-24T16:04:08.401Z",
    "dateReserved": "2026-09-24T14:53:16.871Z",
    "dateUpdated": "2026-09-25T05:10:45.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97452",
      "date": "2026-09-25",
      "epss": "0.0014",
      "percentile": "0.02753"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/acpi/acpica/utcopy.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e16d1e5fcb17dfc369e20095f8cf5e841101279e",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a6cd2fc2d5429a5b7d5a8b9ba0e6663e8ccbc9ba",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6e8c55e13a5e3a9f38921d62924f18ceba3330eb",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.12.111",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.53",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/acpi/acpica/utcopy.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Prevent adding invalid references\n\nPrevent adding references for local, argument, and debug objects\nin acpi_ut_copy_simple_object()."
          }
        ],
        "id": "CVE-2026-97452",
        "lastModified": "2026-09-25T05:17:06.440",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T17:17:23.573",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6e8c55e13a5e3a9f38921d62924f18ceba3330eb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a6cd2fc2d5429a5b7d5a8b9ba0e6663e8ccbc9ba"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e16d1e5fcb17dfc369e20095f8cf5e841101279e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.