Linux Kernel EUVD-2026-86067

Requires the kernel to parse attacker-influenced ACPI/AML: either malicious or tampered platform firmware supplying crafted DSDT/SSDT field definitions, or a privileged local user (CAP_SYS_ADMIN) injecting custom AML via configfs/custom_method. This is NOT reachable by a remote or unprivileged local attacker against a default configuration despite the PR:N in the NVD vector - the AML parser only processes tables provided at boot or by privileged interfaces. Limiting factors: need for firmware control or CAP_SYS_ADMIN, and the crash-dominant nature of the OOB access (denial of service rather than reliable code execution or data theft).

The NVD CVSS 3.1 base of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) presents this as a locally-reachable but unauthenticated, low-complexity flaw with high confidentiality and availability impact. That rating is overstated relative to how the code is actually reached: acpi_ps_get_next_field() is part of the ACPICA AML parser, invoked when the kernel parses ACPI tables (firmware-supplied DSDT/SSDT) or AML injected via configfs/custom_method. Reaching attacker-controlled AML at runtime is not a default, no-privilege path - it requires either malicious firmware/tables or CAP_SYS_ADMIN to load custom AML - so the effective PR:N/AC:L is generous. The fix merely adds boundary checks against out-of-bounds access, so the realistic primary impact is a parser crash (DoS), with confidentiality (C:H) being speculative for an OOB read that is unlikely to be exfiltrated to userspace. There is no EPSS score, no CISA KEV listing, and no public exploit code, consistent with an internally-reported hardening fix rather than an exploited bug. Signals are aligned toward LOW real-world urgency: no exploitation evidence, high practical access requirements, crash-dominant impact. The one conflict to verify: PR:N in the vector versus the description's implicit need to supply crafted ACPI/AML, which in practice requires firmware control or CAP_SYS_ADMIN - treat this as a local, privileged/config-gated availability issue rather than a remote unauthenticated compromise.

An attacker who can supply crafted ACPI tables - via malicious/modified platform firmware, a rogue peripheral option ROM, or a privileged (CAP_SYS_ADMIN) local user loading custom AML through configfs/custom_method - provides a malformed field definition that the AML parser walks past its buffer boundary. Parsing the crafted field triggers an out-of-bounds access in acpi_ps_get_next_field(), causing a kernel crash (denial of service) and potentially an out-of-bounds read. No public exploit code has been identified at time of analysis.