Linux Kernel CVE-2026-97451

Requires the ability to have the kernel's ACPI interpreter execute attacker-controlled AML containing a crafted Mid() (three-operand) operation - realistically via malicious/crafted ACPI firmware tables (DSDT/SSDT) or a privileged path such as debugfs custom_method (root/CAP_SYS_ADMIN). It is NOT reachable by an ordinary unprivileged local user against a default configuration, and it is not remotely reachable. Limiting factors: needs firmware control or root-equivalent access to inject AML, the operand values must be chosen so Index+Length overflows, and vulnerable kernels are those before 6.12.111 / 6.18.53 / 7.2. Impact is dominated by kernel memory corruption and crash (denial of service).

The NVD CVSS of 8.4 (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk for this class of Linux-kernel ACPICA flaw. The bug is an integer overflow in the AML interpreter's Mid() operator (acpi_ex_opcode_3A_1T_1R), where an unchecked Index+Length yields a negative/oversized size passed to memcpy() - a memory-corruption/crash primitive, not a disclosure. Critically, reaching this code path requires executing attacker-influenced AML bytecode, which only comes from ACPI firmware tables (DSDT/SSDT) loaded at boot or from a root-loaded custom_method - so PR:N is misleading; a normal unprivileged local user cannot supply arbitrary AML operands. There is no EPSS score, no CISA KEV listing, and no public POC, so there is no evidence of active or imminent exploitation. Net: this is a legitimate hardening fix but a low-priority, crash-dominant, high-prerequisite issue rather than a high-severity threat. Conflicting signal to verify with vendor: CVSS marks PR:N/AC:L, yet the description implies the operands originate from AML that must be loaded via firmware or privileged interfaces - treat the PR:N/AC:L rating as optimistic.

An attacker able to supply malicious ACPI tables - through control of platform firmware/a crafted DSDT-SSDT, or via a root-privileged custom_method write - crafts a Mid() operation with Index and Length values whose sum overflows. When the interpreter computes the truncation length it passes a negative (wrapped huge) size to memcpy(), corrupting kernel memory or crashing the system. No public exploit code is known at time of analysis.