Linux Kernel EUVD-2026-86058

Exploitation requires the attacker to control the AML resource descriptor data parsed by acpi_ut_walk_aml_resources() - i.e. malformed ACPI resource templates (_CRS/_PRS/_SRS-style buffers) originating from platform firmware, a malicious/rogue device advertising crafted resource data, or a privileged local path that feeds ACPI tables into the kernel. This is a strong limiting factor: unprivileged userspace does not normally reach this parser with attacker-controlled bytes, so despite the PR:N/AC:L in the NVD vector, practical triggering is gated on firmware/hardware or privileged control over ACPI input. Impact is limited to a single system (S:U) and is predominantly a kernel crash rather than data disclosure.

The NVD CVSS 3.1 score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) overstates real-world risk for this ACPICA resource-walker hardening fix. The vector's PR:N/AC:L combination is misleading: acpi_ut_walk_aml_resources() parses AML resource descriptors (e.g. _CRS/_PRS/_SRS templates) sourced from firmware ACPI tables or device-provided data, so triggering the buffer overflow realistically requires the ability to supply a malformed resource template - typically firmware/BIOS control, a malicious peripheral, or a privileged path to inject ACPI data - not trivial low-privilege access. The C:H claim is also questionable; a length-validation overflow in resource parsing is overwhelmingly crash-dominant (A:H via kernel memory corruption/panic) rather than a reliable confidentiality leak. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, indicating no evidence of active or imminent exploitation. This is a defense-in-depth kernel hardening patch (the terse 'Enhance buffer validation ... to prevent buffer overflows' commit message signals proactive validation rather than a demonstrated exploit), so it is a low-to-moderate real-world priority - patch on normal kernel-update cadence rather than as an emergency.

An attacker able to present malformed ACPI resource data - via compromised platform firmware, a malicious hot-pluggable device exposing crafted _CRS/_PRS resource templates, or a privileged local path that injects ACPI tables - causes acpi_ut_walk_aml_resources() to read/write past the resource buffer. The most likely outcome is kernel memory corruption leading to a panic (denial of service). No public exploit code is available and exploitation depends on controlling the AML resource input.