Skip to main content

Linux Kernel EUVDEUVD-2026-86057

| CVE-2026-97444 HIGH
2026-09-24 Linux GHSA-737f-j4h3-g9rc
Buffer Overflow Linux Red Hat Suse
7.7
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain firmware/boot or hypervisor control
  2. Delivery
    Provision malicious ACPI/AML tables
  3. Exploit
    Kernel parses AML at boot/runtime
  4. Execution
    OOB read in namestring/opcode parser
  5. Impact
    Kernel crash or memory leak

Vulnerability Assessment

Exploitation Conditions

Exploitation requires the attacker to control the ACPI tables (AML bytecode) that the kernel parses via acpi_ps_get_next_namestring() and acpi_ps_peek_opcode(). Concretely this means one of: malicious/modified system firmware or BIOS, physical access to override tables at boot, root-level ACPI table override through initrd (CONFIG_ACPI_TABLE_UPGRADE), or a malicious hypervisor supplying crafted tables to a guest. LIMITING FACTORS: an ordinary unprivileged local user cannot normally feed arbitrary AML to this parser, so the PR:N in the supplied vector overstates reachability; there is no network vector, and the realistic outcome is a kernel crash rather than confidentiality loss.
Impact

The input assigns CVSS 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), but this overstates real-world risk. The fix adds boundary checks to acpi_ps_get_next_namestring() and acpi_ps_peek_opcode(), both AML bytecode parsing routines in the kernel's ACPICA subsystem - meaning the attacker-controlled input is ACPI tables (AML), not ordinary syscall data. Supplying malicious ACPI tables is not something an unprivileged local user can normally do; it typically requires firmware/BIOS control, physical access, table override via initrd (root + CONFIG_ACPI_TABLE_UPGRADE), or a malicious hypervisor feeding tables to a guest. This makes the PR:N and AC:L choices questionable - reaching the vulnerable parser realistically needs elevated control over firmware/boot, so AC is higher and PR is not truly none. The impact is also skewed toward availability (a crash from OOB read) rather than the C:H (confidentiality) the vector claims; an OOB read could leak adjacent memory but there is no described disclosure primitive. No EPSS score, no CISA KEV listing, and no public POC are present. Overall this is a defense-in-depth hardening fix for a firmware/physical-gated crash bug, not an urgent remotely-exploitable priority. Verify the attack path with the kernel commit: the PR:N in the vector conflicts with the ACPI-table-provisioning prerequisite implied by the code location.
Exploit ScenarioDerived

An attacker who can supply crafted ACPI tables - via malicious firmware/BIOS, physical boot manipulation, or a hostile hypervisor presenting tables to a guest VM - provides malformed AML that drives the parser past buffer boundaries in acpi_ps_get_next_namestring() or acpi_ps_peek_opcode(), causing an out-of-bounds read. The most likely outcome is a kernel crash (DoS) with a possible leak of adjacent kernel memory. No public exploit code is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Out-of-bounds reads in the Linux kernel's ACPI interpreter (ACPICA) - specifically in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() - can cause a kernel crash or expose adjacent memory contents when parsing malformed AML bytecode from ACPI tables. All kernel versions tracing back to the initial git commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) are affected; fixes are published in Linux 6.12.111 and 6.18.53 (mainline 7.2). Exploitation requires the ability to supply crafted ACPI tables - malicious or modified firmware/BIOS, physical boot-time table override, root-level override via initrd (CONFIG_ACPI_TABLE_UPGRADE), or a hostile hypervisor - which is why our independent assessment lowers the supplied CVSS 7.7 (PR:N, AC:L, C:H) to AV:L/AC:H/PR:L with confidentiality impact limited to adjacent-memory leakage; the realistic outcome is a kernel denial of service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the patch is available from the vendor via the referenced upstream stable commits.

RemediationAI

Vendor-released patches are available: upgrade to Linux 6.12.111 or Linux 6.18.53 on the respective stable branches, or to mainline 7.2, and confirm the fix is present by verifying the tree at the upstream commits 253d7272d01db9529c79b95205c0f859ef9f4f23, 4de2cffef5e6b5b79eec8c934df582459b818228, and bdc35754012906dbf094be104b103ca3adfef6f7. Distributions that backport security fixes should track their kernel advisory for the equivalent patched build. Because exploitation requires control of ACPI tables rather than an unprivileged local foothold, the following compensating controls are practical where immediate patching is not: disable runtime ACPI table upgrade by building without CONFIG_ACPI_TABLE_UPGRADE (or removing the ACPI table overlay from the initrd), which closes the most accessible root-level injection path at the cost of losing firmware-quirk overrides; enforce UEFI Secure Boot and firmware write protection with a strong BIOS/administrator password to make persistent malicious table injection harder, accepting the operational burden of firmware update handling; restrict physical and console access to the hardware so an attacker cannot rewrite or override tables at boot; and, for virtualized workloads, constrain which hypervisors can supply ACPI tables to guests and treat the host as part of the trusted computing base, since a malicious hypervisor can always present crafted AML. Note the fix does not change the trust model - systems that must accept untrusted firmware or untrusted ACPI tables should treat the issue as a potential guest/host availability risk rather than a solved one. Monitor the referenced advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-97444) for updated exploitation status; no public proof-of-concept or confirmed in-the-wild exploitation exists at time of analysis.

Affected VersionsENISA

Linux patch: 6.18.53
Linux patch: 7.2
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <253d7272d01db9529c79b95205c0f859ef9f4f23
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4de2cffef5e6b5b79eec8c934df582459b818228
Linux 0 <6.18.53
Linux patch: 6.12.111
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <bdc35754012906dbf094be104b103ca3adfef6f7
Linux 0 <6.12.111

Affected Packages

euvd linux fix: 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ACPICA is the ACPI Component Architecture reference implementation embedded in the Linux kernel, responsible for parsing ACPI Machine Language (AML) bytecode obtained from system firmware tables (DSDT/SSDT and, when table upgrade is enabled, from initrd-supplied images). The two patched functions are core parser primitives: acpi_ps_peek_opcode() inspects the next AML opcode byte, and acpi_ps_get_next_namestring() decodes the namespace path that follows a name-bearing opcode. Without upper-bound validation on the AML stream pointer/remaining length, a truncated or deliberately malformed table can drive the parser past the end of the AML buffer, producing an out-of-bounds read. The input data assigns no CWE (CWE: N/A) and carries the tags "Buffer Overflow" and "Linux"; the described defect is classically a buffer over-read (out-of-bounds read) in a data-driven parser. Because ACPI tables are generally treated as trusted platform input, the parsing path has no privilege boundary of its own - the security-relevant boundary is whoever controls the firmware image, the boot chain, or the hypervisor. Local unprivileged users cannot normally inject arbitrary AML into this parser, so the PR:N rating in the supplied CVSS vector overstates reachability; the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H) reflects the firmware/hypervisor prerequisite and the primarily availability-focused impact.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.7 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 5.3 MEDIUM

Reaching the AML parser needs control over ACPI tables (firmware/boot/hypervisor), so AC:H and PR:L; OOB read is crash-dominant (A:H) with only incidental leak (C:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
7.7 (HIGH)
Patch available
Sep 24, 2026 - 17:03 EUVD
CVE Published
Sep 24, 2026 - 16:03 cve.org
HIGH 7.7
CVE Published
Sep 24, 2026 - 16:03 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: add boundary checks in two places

Add boundary checks in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() to prevent out-of-bounds access.

Executive ViewAI

Why It Matters

The Linux kernel's ACPI interpreter contains out-of-bounds read flaws that can crash systems and leak limited adjacent memory when malformed firmware tables are processed. This primarily threatens availability for organizations running affected kernels, especially where firmware, hypervisors, or boot-time ACPI overrides are not tightly controlled, and could affect servers, cloud hosts, and appliances. No public exploit identified at time of analysis, and vendor patches are available, so leadership should prioritize patching to 6.12.111 or 6.18.53 and hardening privileged boot and firmware pathways.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
Ubiquitous
ACPICA/ACPI parsing is present in virtually all x86 Linux systems
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97444 ADVISORY https://vuldb.com/vuln/409601 REF https://git.kernel.org/stable/c/253d7272d01db9529c79b95205c0f859ef9f4f23 REF https://git.kernel.org/stable/c/38ee32a9ace6fae8965f059b38e6e7fb27b1e7ce REF https://git.kernel.org/stable/c/3a8c1efc0fd3abb2d2b1254315f36db03abc88eb REF https://git.kernel.org/stable/c/4de2cffef5e6b5b79eec8c934df582459b818228 REF https://git.kernel.org/stable/c/4f03d84c95a51436878cd750a14f8ca37eeb3112 REF https://git.kernel.org/stable/c/bdc35754012906dbf094be104b103ca3adfef6f7 REF https://git.kernel.org/stable/c/c917df56b73719a2d4cee1c4ab4a6626acb95315

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy