Skip to main content

Linux Kernel EUVDEUVD-2026-86063

| CVE-2026-97450 HIGH
2026-09-24 Linux GHSA-pxrx-c992-xr3q
Information Disclosure Linux Suse
8.4
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local privileged access (CAP_SYS_ADMIN)
  2. Delivery
    Load malicious ACPI/AML table
  3. Exploit
    Trigger handler lookup with wrong object type
  4. Execution
    Type confusion in ACPICA region handler
  5. Impact
    Kernel invalid deref / crash (DoS)

Vulnerability Assessment

Exploitation Conditions

Reachable only when an attacker can supply ACPI/AML that drives acpi_ev_has_default_handler() or acpi_ev_find_region_handler() to operate on a handler object of an unexpected type - practically requiring the ability to override ACPI tables (CONFIG_ACPI_CONFIGFS table load, typically CAP_SYS_ADMIN) or to control platform firmware/DSDT. Limiting factors: local access only (AV:L), effectively privileged despite the vector's PR:N, no user interaction, and dependence on a niche configuration (custom-table loading enabled) rather than any default remote-facing service.
Impact

The NVD CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) substantially overstates real-world risk. The vector itself is internally inconsistent for this bug class: it claims PR:N (no privileges) yet AV:L (local), which is contradictory for an ACPICA change that can only be reached by loading attacker-controlled ACPI/AML tables - an action that in practice requires CAP_SYS_ADMIN (configfs ACPI table override) or malicious firmware/DSDT, not an unprivileged user. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so all exploitation-probability signals point low. The fix is a defensive object-type validation ('validate handler object type in two places'), which is characteristic of hardening against type confusion / invalid dereference (CWE-843/754) whose realistic outcome is a kernel crash (DoS) rather than reliable C:H/I:H code execution. Net: this is a high-CVSS-but-low-real-risk kernel hardening fix, not an urgent priority - verify with the kernel commit that the trigger genuinely requires privileged table loading, as the PR:N in the vector is not credible for this path.
Exploit ScenarioDerived

A local attacker with the ability to load a custom ACPI table (e.g. via CONFIG_ACPI_CONFIGFS with CAP_SYS_ADMIN, or a tampered firmware/DSDT) crafts AML that installs or looks up an address-space/region handler whose object type is not what ACPICA expects. When acpi_ev_has_default_handler() or acpi_ev_find_region_handler() operates on the mistyped object, the type confusion leads to an invalid dereference and a likely kernel crash. No public proof-of-concept exists, and the local, privilege-dependent nature makes opportunistic exploitation unlikely.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

The Linux kernel's ACPICA interpreter fails to validate the object type of handler objects in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(), so malformed or crafted ACPI/AML tables can drive those paths to operate on a handler of an unexpected type. Exploitation is local and practical only for an attacker who can supply the AML - most plausibly by overriding ACPI tables via CONFIG_ACPI_CONFIGFS table loading (which normally requires CAP_SYS_ADMIN) or by controlling platform firmware/DSDT, and no public exploit or confirmed active exploitation was identified at time of analysis. Our independent assessment rates real-world risk substantially below the published NVD CVSS 3.1 score of 8.4, since the attack is local, depends on a non-default custom-table-loading configuration, and yields integrity/availability impact rather than code execution.

RemediationAI

Upgrade to a kernel containing the fixed backports: Linux 6.18.53 or later on the 6.18 line, Linux 6.12.111 or later on the 6.12 line, or the equivalent mainline fix targeted for 7.2, corresponding to upstream commits bfd981d35ed3156414fd35b4fe311d5d25cbfca6 (6.18), c5296da2d516707862f8a2dbb4b515f777e5294f (6.12), and 4c977d57a784682dc8c6cce2f9253ef44ec28ae8; see https://nvd.nist.gov/vuln/detail/CVE-2026-97450 and commit links at git.kernel.org for verification. The fix is available from the vendor, so patching is the primary action. Where patching must be deferred, reduce exposure by preventing untrusted AML from reaching the vulnerable handlers: disable runtime ACPI table loading overrides (CONFIG_ACPI_CONFIGFS and acpi_configfs table-install paths) so that only signed/existing firmware tables are interpreted, and restrict or audit write access to /sys/kernel/config/acpi/table and to the CAP_SYS_ADMIN capability that authorizes it - the trade-off is loss of dynamic ACPI table testing/override capability for debugging and development. Locking down the boot chain and physical/firmware update access (secure boot, firmware write protection) similarly limits the alternative vector of a manipulated platform DSDT, at the cost of operational flexibility for firmware maintenance.

Affected VersionsENISA

Linux patch: 6.18.53
Linux 0 <6.18.53
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <bfd981d35ed3156414fd35b4fe311d5d25cbfca6
Linux 0 <6.12.111
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <c5296da2d516707862f8a2dbb4b515f777e5294f
Linux patch: 6.12.111
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4c977d57a784682dc8c6cce2f9253ef44ec28ae8
Linux patch: 7.2

Affected Packages

euvd linux fix: 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ACPICA is the reference ACPI Component Architecture implementation whose interpreter the Linux kernel embeds to evaluate AML (ACPI Machine Language) and to dispatch operation-region accesses to handlers. In acpi_ev_has_default_handler() and acpi_ev_find_region_handler(), the code walked the ACPI handler lists without first confirming that the resolved object actually is an ACPI handler object, meaning a handler entry of an unexpected type could be returned and subsequently dereferenced. The root cause class is improper/insufficient object-type validation (a CWE-20/CWE-704-style type-confusion condition), where trust in the AML-supplied table structure leads to use of a mistyped object. The upstream fixes are in the stable commits bfd981d35ed3156414fd35b4fe311d5d25cbfca6, c5296da2d516707862f8a2dbb4b515f777e5294f, and 4c977d57a784682dc8c6cce2f9253ef44ec28ae8, which add the missing type checks before the handler is used. Affected CPEs are linux:linux across the affected stable branches, with EUVD listing fixes in Linux 6.18.53, 6.12.111, and 7.2; the flaw has existed since the initial 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 commit and is reachable across all affected 0-day-through-fixed version ranges.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.3 MEDIUM

Trigger needs local privileged ACPI-table loading (PR:L, AV:L) and a mistyped-handler race/edge (AC:H); realistic impact is a kernel crash (A:H) with at most incidental I:L and no confidentiality.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 2.3 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
8.4 (HIGH)
Patch available
Sep 24, 2026 - 17:03 EUVD
CVE Published
Sep 24, 2026 - 16:04 cve.org
HIGH 8.4
CVE Published
Sep 24, 2026 - 16:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: validate handler object type in two places

ACPICA: validate handler object type in acpi_ev_has_default_handler() and acpi_ev_find_region_handler().

Executive ViewAI

Why It Matters

A high-severity flaw in the Linux kernel's ACPI interpreter (ACPICA) allows crafted ACPI/AML tables to drive handler-lookup routines into operating on an object of the wrong type, potentially causing kernel instability or integrity and availability failures on affected hosts. Exploitation is local rather than remote, and requires either privileged control over ACPI table loading (typically CAP_SYS_ADMIN with the non-default CONFIG_ACPI_CONFIGFS option enabled) or control of platform firmware, which materially narrows the realistic threat surface for our environment. Leadership should care primarily because remediation requires coordinated kernel patching across server and endpoint fleets, and because a vendor fix is already available - the exposure is manageable but time-bound.

Business Impact: Medium
Compensating Controls

Apply vendor patch. Where the vendor kernel patch cannot be deployed immediately, disable CONFIG_ACPI_CONFIGFS or otherwise block runtime custom ACPI table loading, tightly restrict CAP_SYS_ADMIN and privileged local access, and enforce firmware/DSDT integrity verification so untrusted AML cannot be introduced.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
Ubiquitous
ACPICA is core to the Linux kernel, present in nearly all x86/ARM systems
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97450 ADVISORY https://vuldb.com/vuln/409603 REF https://git.kernel.org/stable/c/254e304f68dc079906ce2df4723548ffe35f682a REF https://git.kernel.org/stable/c/4c977d57a784682dc8c6cce2f9253ef44ec28ae8 REF https://git.kernel.org/stable/c/7af2da201623ab5bc0773bd3eeb2f2345cfa1c4a REF https://git.kernel.org/stable/c/9d9fbf6b895a23238e4a7b1a3230f648f0d952a1 REF https://git.kernel.org/stable/c/bfd981d35ed3156414fd35b4fe311d5d25cbfca6 REF https://git.kernel.org/stable/c/c5296da2d516707862f8a2dbb4b515f777e5294f REF https://git.kernel.org/stable/c/e98825650c2eb1605c707fd1391ceed65bb8e481

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy