CVE-2026-64512 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ACPI: CPPC: Suppress UBSAN warning caused by field misuse
The definition of reg->access_width changes depending on the reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses access_width to indicate the PCC region, which can result in a UBSAN if the value is greater than 4.
For example:
UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9 shift exponent 32 is too large for 32-bit type 'int' CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy) Hardware name: To be filled by O.E.M. Call trace: ...(trimming) ubsan_epilogue+0x10/0x48 __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0 cpc_write+0x4d0/0x670 cppc_set_perf+0x18c/0x490 cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq]
... (trimming)
Lets fix this by validating the region type, as well as whether access_width has a value. Then since we are returning bit_width directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting the size.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability involves a undefined behavior issue in the Linux kernel's ACPI Common Platform Properties Control (CPPC) implementation that manifests through UBSAN (Undefined Behavior Sanitizer) warnings. This occurs when processing register access widths for different address space types within the ACPI subsystem, specifically affecting the platform communication channel (PCC) region handling on arm64 architectures.
The core technical flaw stems from improper handling of the reg->access_width field which varies based on the reg->space_id type. When dealing with ACPI_ADR_SPACE_PLATFORM_COMM type regions, the access_width value is used to indicate PCC region characteristics but can exceed acceptable bounds for 32-bit integer operations. The specific error manifests as a shift-out-of-bounds condition in the cppc_acpi.c file at line 1090 where a 32-bit shift operation attempts to use an exponent of 32, which exceeds the maximum allowed shift value for 32-bit integers and triggers UBSAN.
This vulnerability presents significant operational impact as it can cause system instability during CPU frequency scaling operations through the cppc_cpufreq driver. The issue occurs during udev worker processes when attempting to initialize CPU frequency scaling capabilities, potentially leading to kernel panics or system crashes. The attack surface is primarily limited to systems running on arm64 architectures with ACPI CPPC support enabled and active CPU frequency management.
The fix implements proper validation of region types and access_width values before processing them, ensuring that only valid values are used in bit manipulation operations. Additionally, the solution removes redundant code that was attempting to correct size values for ACPI_ADR_SPACE_PLATFORM_COMM regions since the implementation now directly returns bit_width values. This approach aligns with CWE-758 recommendations for undefined behavior prevention and follows ATT&CK techniques related to kernel exploitation prevention through proper input validation and sanitization. The mitigation strategy focuses on defensive programming practices that prevent out-of-bounds operations while maintaining the intended functionality of platform communication channel handling in ACPI implementations.
The vulnerability demonstrates a classic case of improper bounds checking in kernel space code where assumptions about data field sizes are not validated before use, creating potential for arbitrary code execution or system crashes through undefined behavior exploitation. The fix addresses both the immediate UBSAN warning and underlying architectural assumptions about register access width handling across different ACPI address space types.