Linux Kernel EUVD-2026-86068

Requires the attacker to control ACPI/AML content executed by the ACPICA interpreter: either malicious platform firmware providing crafted DSDT/SSDT tables, or a local privileged user (CAP_SYS_ADMIN) injecting AML via configfs/ACPI custom_method. Exploitation is bounded to defining a control method that, on termination in acpi_ds_terminate_control_method(), leaves stale references to method locals/arguments. Limiting factors: no remote or network path exists, no unprivileged trigger on default configurations, the outcome is predominantly a kernel crash (DoS) rather than reliable code execution, and systems on kernels 6.12.111 / 6.18.53 / 7.2 or later are patched.

This is the classic Linux-kernel-CVE profile where the raw score overstates real-world risk. NVD scores 8.4 with CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but that vector is inconsistent with the actual trigger. A use-after-free in acpi_ds_terminate_control_method() is reached only through the ACPICA AML interpreter, which executes control methods from ACPI tables (DSDT/SSDT). Those tables come from platform firmware or, at runtime, from a privileged local operator injecting AML via configfs/custom_method (requiring CAP_SYS_ADMIN). That contradicts PR:N: there is no unauthenticated, unprivileged path to feed attacker-controlled AML on a normally configured system, so AC:L/PR:N is generous. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so all exploitation-probability signals are absent or low. The stated C:H/I:H is also questionable - a UAF of freed method locals/arguments is overwhelmingly a stability/crash (DoS) primitive; disclosure or code execution would require a difficult, kernel-version-specific heap-grooming exploit not evidenced here. Bottom line: patch it as routine kernel hygiene, but this is not a drop-everything priority. Key conflict to verify: CVSS advertises unauthenticated local access (AV:L/PR:N) while the code path requires either trusted firmware or CAP_SYS_ADMIN-level AML injection - treat auth requirements as vendor-unconfirmed.

An attacker with the ability to supply malicious ACPI/AML - either via crafted platform firmware/DSDT on a device they physically control, or as a root/CAP_SYS_ADMIN local user loading AML through configfs custom_method - defines a control method whose termination leaves stale references to method locals and arguments. When acpi_ds_terminate_control_method() runs, the kernel dereferences freed objects, typically crashing the host (DoS), with a theoretical path to memory corruption. No public exploit code is identified at time of analysis.