Linux Kernel EUVD-2026-86065

Requires the kernel ACPI/AML interpreter to process attacker-influenced ACPI tables. Concretely, exploitation needs one of: (1) malicious or modified platform firmware providing crafted DSDT/SSDT tables, or (2) local loading of a custom ACPI table via configfs (ACPI_CONFIGFS/table upload), which requires CAP_SYS_ADMIN. The vulnerable path is acpi_ut_copy_simple_object() copying a reference to a local/argument/debug object during AML execution. Limiting factors: no network vector (AV:L), no unauthenticated remote reach despite PR:N in the published vector, dependence on privileged table injection or physical/firmware control, and impact realistically limited to a kernel crash rather than disclosure or code execution.

This is a high-CVSS-but-lower-real-risk issue. The NVD/Linux CVSS of 8.4 (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates practical severity. The vector correctly uses AV:L (local), but the C:H/I:H/A:H triad and PR:N are misleading for an ACPICA interpreter fix: the bug is reached by parsing ACPI/AML bytecode, which in practice means either attacker-supplied firmware (physical/supply-chain) or loading a custom ACPI table via configfs, which requires CAP_SYS_ADMIN - so PR:N is generous and confidentiality/integrity impact is doubtful. The fix simply prevents adding references for local, argument, and debug objects in acpi_ut_copy_simple_object(), which is a type-confusion/invalid-reference hardening (CWE-843/754) whose realistic worst case is a kernel crash/DoS, not information disclosure or code execution. No exploitation signals reinforce urgency: no EPSS score, not on CISA KEV, and no public POC - no public exploit identified at time of analysis. The 'Information Disclosure' tag conflicts with the actual defect (memory-safety on transient interpreter objects) and should be treated as mislabeled. Net: patch on normal cadence; not an emergency for typical fleets.

An attacker who can supply a crafted ACPI table - via malicious/modified platform firmware or by loading a custom table through configfs with CAP_SYS_ADMIN - triggers AML that causes acpi_ut_copy_simple_object() to add a reference to a local, argument, or debug object, producing a type-confusion/invalid reference in the kernel ACPI interpreter. The most realistic outcome is a kernel crash (denial of service). No public exploit code is known.