CVE-2026-97445 (GCVE-0-2026-97445)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:04 – Updated: 2026-09-25 12:44
VLAI
Title
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
Summary
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() Enhance buffer validation in acpi_ut_walk_aml_resources() to prevent buffer overflows.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f65e2ef7ccca11dc874f48aff996a6a26528f8e7 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d0fb1973f705c8b8bd7e118e4a9a65d05d800fba (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/acpica/utresrc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f65e2ef7ccca11dc874f48aff996a6a26528f8e7",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d0fb1973f705c8b8bd7e118e4a9a65d05d800fba",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/acpica/utresrc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()\n\nEnhance buffer validation in acpi_ut_walk_aml_resources() to prevent\nbuffer overflows."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Malformed AML resource bytes arrive in a Buffer from DSDT/SSDT, not a network message. acpi_ut_walk_aml_resources() is reached from acpi_ex_concat_template() during acpi_bus_init\u2192acpi_load_tables\u2192acpi_ns_load_table (ConcatenateResTemplate) and from acpi_rs_create_resource_list() via acpi_dev_get_resources() on _CRS; both are local firmware paths.\nAC:L - A Buffer whose remaining length is below sizeof(aml_resource_end_tag), a large descriptor shorter than the serial_bus.type field, or a 16-bit Resource Length larger than end_aml-aml makes acpi_ut_validate_resource() and acpi_rs_convert_aml_to_resources() over-read on every walk; the table author sets those bytes and no race is required.\nPR:N - acpi_bus_init() calls acpi_load_tables() which executes module-level ConcatenateResTemplate, and acpi_dev_get_resources() walks _CRS during scan, neither with a uid or capability check; a compromised DSDT/SSDT is enough with no local account.\nUI:N - acpi_ns_execute_table() evaluates module-level AML during acpi_load_tables(), and acpi_scan_claim_resources()/acpi_dev_get_resources() walk _CRS while claiming device resources; both run on ordinary power-on with no mount, file-open, or other victim action.\nS:U - The over-read is of kernel heap adjacent to the ACPI Buffer object\u0027s payload (acpi_ut_create_buffer_object) inside the host ACPICA interpreter; it does not cross a KVM/Xen, IOMMU, or sandbox boundary.\nC:H - Without the length\u003e(end_aml-aml) check, a large vendor/GPIO/serial descriptor whose 16-bit Resource Length exceeds the remaining Buffer lets acpi_rs_convert_aml_to_resource() ACPI_RSC_MOVE*/COUNT16 copy up to that claimed length from past the heap allocation, an unbounded kernel overread rather than a few header bytes.\nI:N - AddressSanitizer and the patch comments describe a READ past the AML Buffer; acpi_ut_walk_aml_resources() only validates and optionally converts into a separately sized resource list, and ConcatenateResTemplate (user_function NULL) never stores through the over-read pointer, so there is no out-of-bounds write primitive.\nA:H - acpi_ut_validate_resource() reading common_serial_bus.type or acpi_rs_move_data() copying a claimed Resource Length past the Buffer object walks off the slab allocation and can oops/panic, matching the reported KASAN heap-buffer-overflow in AcpiUtValidateResource on the ConcatenateResTemplate path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:44:23.085Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f65e2ef7ccca11dc874f48aff996a6a26528f8e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0fb1973f705c8b8bd7e118e4a9a65d05d800fba"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d"
        }
      ],
      "title": "ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97445",
    "datePublished": "2026-09-24T16:04:00.409Z",
    "dateReserved": "2026-09-24T14:53:16.870Z",
    "dateUpdated": "2026-09-25T12:44:23.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97445",
      "date": "2026-09-25",
      "epss": "0.00155",
      "percentile": "0.03889"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/acpi/acpica/utresrc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f65e2ef7ccca11dc874f48aff996a6a26528f8e7",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d0fb1973f705c8b8bd7e118e4a9a65d05d800fba",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/acpi/acpica/utresrc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.12"
                  },
                  {
                    "lessThan": "2.6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()\n\nEnhance buffer validation in acpi_ut_walk_aml_resources() to prevent\nbuffer overflows."
          }
        ],
        "id": "CVE-2026-97445",
        "lastModified": "2026-09-25T13:17:28.263",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T17:17:22.773",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d0fb1973f705c8b8bd7e118e4a9a65d05d800fba"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f65e2ef7ccca11dc874f48aff996a6a26528f8e7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.