EUVD-2026-80504
GHSA-f448-wjgg-crg4
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Overflow needs high socket-count VM topology/ACPI config control (PR:H, AC:H) applied locally at boot; impact is memory corruption causing crash (A:H), no confidentiality and only incidental integrity.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Fix acpi_package_ids[] array overflow
With LoongArch virt machine, a typical setting is one core per socket, there will max 256 sockets (packages) on one VM. With PPTT acpi table, array acpi_package_ids[] will be overflowed.
Here change the array size of acpi_package_ids[] with the max value of MAX_PACKAGES and KVM_MAX_VCPUS.
AnalysisAI
LoongArch Linux kernels overflow the fixed-size acpi_package_ids[] array while parsing the ACPI PPTT table, so a system whose firmware or hypervisor advertises more CPU packages (sockets) than the array can hold crashes during topology setup - the concrete case in the description being a LoongArch virt VM configured with one core per socket for up to 256 sockets. Affected builds are those before the fixed 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1 kernels; the flaw is reachable only on LoongArch, and the assessed precondition (per our independent analysis: AV:L/AC:H/PR:H, C:N/I:L/A:H) is control over the guest's ACPI topology rather than an ordinary unprivileged runtime action, with the practical outcome being a boot-time crash and memory corruption rather than remote code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a LoongArch system - specifically the virt (VM) machine type - whose ACPI PPTT table declares more packages/sockets than the fixed acpi_package_ids[] array can hold; the description's concrete trigger is a topology of 256 sockets with one core per socket. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a boot-time buffer overflow (CWE-787) in the LoongArch ACPI PPTT parser: a fixed acpi_package_ids[] array overflows when a system presents more packages than the array can hold - the description's concrete case is a LoongArch virt VM with one core per socket yielding up to 256 sockets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released fixes: update to Linux 6.12.110, 6.18.51, 7.2.5 or 7.3-rc1 (whichever matches your series), or cherry-pick the upstream fix commits 0195e04b1eec8fb00e2db9c5e55655a3f5e76f60, d3fd094c13c6d0b74f246461ca4cf427d539c8e8, 6311b8c471afa33c18adbe4eb16f862936b71ca3 or 2a2367d46d7a4ee4122b7a86e57125542dbbe963 from https://git.kernel.org/stable/c/ - the change simply enlarges acpi_package_ids[] to cover MAX_PACKAGES/KVM_MAX_VCPUS, so it is small and low-risk to backport. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every LoongArch Linux host and guest and compare running kernel versions against the fixed releases (6.12.110, 6.18.51, 7.2.5 and 7.3-rc1), flagging anything below those thresholds and prioritizing virtualized guests configured with unusually high socket or package counts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today