GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89587 (GCVE-0-2026-89587)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:01
VLAI
Title
ACPI: pfr_update: fix stack buffer overflow in query_capability()
Summary
In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: fix stack buffer overflow in query_capability() query_capability() copies four ACPI buffer objects returned by the firmware _DSM into fixed-size u8[16] fields in struct pfru_update_cap_info using memcpy with the firmware-supplied length: memcpy(&cap_hdr->code_type, elements[CAP_CODE_TYPE_IDX].buffer.pointer, elements[CAP_CODE_TYPE_IDX].buffer.length); The same pattern repeats for drv_type, platform_id, and oem_id. If the firmware returns buffer.length > 16 for any of these fields, memcpy writes past the destination array. struct pfru_update_cap_info is stack-allocated in pfru_ioctl(). Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports are generated when a DSM returns 64-byte buffers, with writes reaching 44 bytes past the end of cap_hdr's [64, 156) frame window into adjacent stack redzones. Introduce a helper pointer to out_obj->package.elements and use it to validate each buffer length against its destination field size before copying, returning -EINVAL if the firmware supplies an oversized buffer.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0db89fa243e5edc5de38c88b369e4c3755c5fb74 , < d3af83e327565a9444cebc0db714cb837e493046 (git)
Affected: 0db89fa243e5edc5de38c88b369e4c3755c5fb74 , < c5a31b4e7e37c92550be9a2edf51ca853a4d251a (git)
Affected: 0db89fa243e5edc5de38c88b369e4c3755c5fb74 , < a2151624b55029dad0ca7efd17fb83a0461c8843 (git)
Affected: 0db89fa243e5edc5de38c88b369e4c3755c5fb74 , < 6d4ed2fd022bc862b156e53aae163b61259e1caa (git)
Affected: 0db89fa243e5edc5de38c88b369e4c3755c5fb74 , < 15d2b7f38f95d28652170344f39ee492c55e567c (git)
Affected: 0db89fa243e5edc5de38c88b369e4c3755c5fb74 , < ced45be0073a8a31b30b4a7f68cd3a15734515de (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/pfr_update.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d3af83e327565a9444cebc0db714cb837e493046",
              "status": "affected",
              "version": "0db89fa243e5edc5de38c88b369e4c3755c5fb74",
              "versionType": "git"
            },
            {
              "lessThan": "c5a31b4e7e37c92550be9a2edf51ca853a4d251a",
              "status": "affected",
              "version": "0db89fa243e5edc5de38c88b369e4c3755c5fb74",
              "versionType": "git"
            },
            {
              "lessThan": "a2151624b55029dad0ca7efd17fb83a0461c8843",
              "status": "affected",
              "version": "0db89fa243e5edc5de38c88b369e4c3755c5fb74",
              "versionType": "git"
            },
            {
              "lessThan": "6d4ed2fd022bc862b156e53aae163b61259e1caa",
              "status": "affected",
              "version": "0db89fa243e5edc5de38c88b369e4c3755c5fb74",
              "versionType": "git"
            },
            {
              "lessThan": "15d2b7f38f95d28652170344f39ee492c55e567c",
              "status": "affected",
              "version": "0db89fa243e5edc5de38c88b369e4c3755c5fb74",
              "versionType": "git"
            },
            {
              "lessThan": "ced45be0073a8a31b30b4a7f68cd3a15734515de",
              "status": "affected",
              "version": "0db89fa243e5edc5de38c88b369e4c3755c5fb74",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/pfr_update.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: pfr_update: fix stack buffer overflow in query_capability()\n\nquery_capability() copies four ACPI buffer objects returned by the\nfirmware _DSM into fixed-size u8[16] fields in struct\npfru_update_cap_info using memcpy with the firmware-supplied length:\n\n  memcpy(\u0026cap_hdr-\u003ecode_type,\n         elements[CAP_CODE_TYPE_IDX].buffer.pointer,\n         elements[CAP_CODE_TYPE_IDX].buffer.length);\n\nThe same pattern repeats for drv_type, platform_id, and oem_id.\nIf the firmware returns buffer.length \u003e 16 for any of these fields,\nmemcpy writes past the destination array.\n\nstruct pfru_update_cap_info is stack-allocated in pfru_ioctl().\n\nConfirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports\nare generated when a DSM returns 64-byte buffers, with writes reaching\n44 bytes past the end of cap_hdr\u0027s [64, 156) frame window into\nadjacent stack redzones.\n\nIntroduce a helper pointer to out_obj-\u003epackage.elements and use it\nto validate each buffer length against its destination field size\nbefore copying, returning -EINVAL if the firmware supplies an\noversized buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached only via local ioctl(PFRU_IOC_QUERY_CAP) or write() on /dev/acpi_pfr_updateN (pfru_ioctl/pfru_write \u2192 query_capability). No network, Bluetooth, USB, or packet path evaluates this ACPI _DSM copy.\nAC:L - A single ioctl or write deterministically copies firmware-supplied _DSM buffer lengths into 16-byte stack fields; KASAN reproduced 64-byte DSM buffers writing 44 bytes past cap_hdr. No race or attacker-uncontrollable memory layout is required.\nPR:L - The ioctl/write path has no capable() or namespace check; access is only DAC on the misc device. Although pfrut checks uid 0 and devtmpfs defaults to 0600, Intel PFRU servers reasonably grant /dev/acpi_pfr_updateN to a firmware-management account or container, so privileges are Low.\nUI:N - The attacker opens the device and issues PFRU_IOC_QUERY_CAP or write() themselves; no separate victim action such as mounting a filesystem or opening a hostile file is required.\nS:U - The overflow corrupts the calling task\u0027s kernel stack inside the host kernel. This is local privilege escalation within one security authority, not a VM escape, IOMMU bypass, or sandbox breakout.\nC:H - Firmware-controlled memcpy overflows four u8[16] stack fields and adjacent frame state (KASAN: 44 bytes past cap_hdr), which per kernel guidance is memory corruption leverageable for arbitrary kernel memory disclosure.\nI:H - This is a kernel stack buffer overflow of firmware-controlled length and contents into stack-allocated struct pfru_update_cap_info, overwriting saved registers and the return address and enabling control-flow hijacking.\nA:H - The same out-of-bounds stack writes were confirmed by KASAN and can oops, trip the stack protector, or panic the kernel; the ioctl can be repeated to deny availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:14.959Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d3af83e327565a9444cebc0db714cb837e493046"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5a31b4e7e37c92550be9a2edf51ca853a4d251a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2151624b55029dad0ca7efd17fb83a0461c8843"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d4ed2fd022bc862b156e53aae163b61259e1caa"
        },
        {
          "url": "https://git.kernel.org/stable/c/15d2b7f38f95d28652170344f39ee492c55e567c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ced45be0073a8a31b30b4a7f68cd3a15734515de"
        }
      ],
      "title": "ACPI: pfr_update: fix stack buffer overflow in query_capability()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89587",
    "datePublished": "2026-09-11T19:44:52.066Z",
    "dateReserved": "2026-09-11T19:38:34.729Z",
    "dateUpdated": "2026-09-14T12:01:14.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89587",
      "date": "2026-09-16",
      "epss": "0.00142",
      "percentile": "0.03923"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:48:44.000Z",
      "cve": "CVE-2026-89587",
      "id": "msrc_CVE-2026-89587",
      "initial_release_date": "2026-09-13T01:02:38.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ACPI: pfr_update: fix stack buffer overflow in query_capability()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89587.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89587\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:43.170\",\"lastModified\":\"2026-09-14T13:19:13.060\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nACPI: pfr_update: fix stack buffer overflow in query_capability()\\n\\nquery_capability() copies four ACPI buffer objects returned by the\\nfirmware _DSM into fixed-size u8[16] fields in struct\\npfru_update_cap_info using memcpy with the firmware-supplied length:\\n\\n  memcpy(\u0026cap_hdr-\u003ecode_type,\\n         elements[CAP_CODE_TYPE_IDX].buffer.pointer,\\n         elements[CAP_CODE_TYPE_IDX].buffer.length);\\n\\nThe same pattern repeats for drv_type, platform_id, and oem_id.\\nIf the firmware returns buffer.length \u003e 16 for any of these fields,\\nmemcpy writes past the destination array.\\n\\nstruct pfru_update_cap_info is stack-allocated in pfru_ioctl().\\n\\nConfirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports\\nare generated when a DSM returns 64-byte buffers, with writes reaching\\n44 bytes past the end of cap_hdr\u0027s [64, 156) frame window into\\nadjacent stack redzones.\\n\\nIntroduce a helper pointer to out_obj-\u003epackage.elements and use it\\nto validate each buffer length against its destination field size\\nbefore copying, returning -EINVAL if the firmware supplies an\\noversized buffer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/acpi/pfr_update.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0db89fa243e5edc5de38c88b369e4c3755c5fb74\",\"lessThan\":\"d3af83e327565a9444cebc0db714cb837e493046\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0db89fa243e5edc5de38c88b369e4c3755c5fb74\",\"lessThan\":\"c5a31b4e7e37c92550be9a2edf51ca853a4d251a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0db89fa243e5edc5de38c88b369e4c3755c5fb74\",\"lessThan\":\"a2151624b55029dad0ca7efd17fb83a0461c8843\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0db89fa243e5edc5de38c88b369e4c3755c5fb74\",\"lessThan\":\"6d4ed2fd022bc862b156e53aae163b61259e1caa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0db89fa243e5edc5de38c88b369e4c3755c5fb74\",\"lessThan\":\"15d2b7f38f95d28652170344f39ee492c55e567c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0db89fa243e5edc5de38c88b369e4c3755c5fb74\",\"lessThan\":\"ced45be0073a8a31b30b4a7f68cd3a15734515de\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/acpi/pfr_update.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/15d2b7f38f95d28652170344f39ee492c55e567c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6d4ed2fd022bc862b156e53aae163b61259e1caa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a2151624b55029dad0ca7efd17fb83a0461c8843\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c5a31b4e7e37c92550be9a2edf51ca853a4d251a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ced45be0073a8a31b30b4a7f68cd3a15734515de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d3af83e327565a9444cebc0db714cb837e493046\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:58:31+00:00",
      "cve": "CVE-2026-89587",
      "id": "CVE-2026-89587",
      "initial_release_date": "2026-09-11T19:44:52.066000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Stack buffer overflow in ACPI pfr_update can lead to memory corruption.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89587.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.