CVE-2026-92522 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ACPI: processor: validate MADT IOAPIC entry bounds
The IOAPIC hotplug lookup parses both MADT and _MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generic header. The _MAT path likewise passed a generic header to the IOAPIC helper.
Validate that a current record has a complete generic header, that its declared length is contained in the available record range, and that a typed IOAPIC record contains the full fixed IOAPIC body before reading its fields. Use the same relation for both MADT and _MAT provider paths.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's Advanced Configuration and Power Interface subsystem contains a critical validation deficiency within the ACPI processor hotplug lookup mechanism, specifically concerning how it processes Multiple APIC Description Table entries and Machine Abstraction Table records. This vulnerability stems from an improper handling of table boundaries during the parsing of IOAPIC (I/O Advanced Programmable Interrupt Controller) structures. The core technical flaw lies in the fact that the MADT walk previously relied on a subtable's declared length to advance its internal cursor after locating only a generic header, without verifying if this declaration was valid within the context of the available record range or if it included sufficient data for the specific IOAPIC type being processed. Similarly, the _MAT path suffered from an analogous issue where it passed a generic header directly to the IOAPIC helper function without ensuring that the typed IOAPIC record contained the full fixed body required for safe field access. This lack of rigorous bounds checking creates a scenario where malformed or maliciously crafted ACPI tables could cause the kernel to read memory outside of valid boundaries, potentially leading to out-of-bounds reads or writes depending on how subsequent parsing logic utilizes these invalid pointers.
From an operational impact perspective, this vulnerability allows for potential denial of service conditions and information disclosure through local privilege escalation vectors if exploited by a user with access to ACPI table injection mechanisms or physical hardware manipulation capabilities. An attacker could craft a malicious MADT or _MAT entry that declares a length exceeding the actual available data in the firmware-provided structure. When the kernel attempts to parse this malformed record, it may read uninitialized memory or sensitive kernel structures located adjacent to the ACPI tables in RAM. This behavior aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write vulnerabilities, as the system fails to validate that the data being accessed is within the allocated buffer limits defined by the firmware. The absence of these checks undermines the integrity of the kernel's hardware abstraction layer, which is fundamental for stable system operation during CPU hotplug events or initial boot sequences involving interrupt controller configuration.
The remediation strategy implemented in this resolution involves enforcing strict validation rules across both MADT and _MAT provider paths to ensure data integrity before any field access occurs. The fix mandates that the kernel must first verify that a current record possesses a complete generic header, ensuring basic structural validity. Furthermore it requires validating that the declared length of each subtable is strictly contained within the available record range provided by the firmware. Crucially for IOAPIC specific processing, the code now checks that a typed IOAPIC record contains the full fixed body before attempting to read its fields, preventing access to incomplete or truncated data structures. This unified approach ensures consistency between different ACPI table parsing routines and eliminates the ambiguity that previously allowed out-of-bounds accesses. By implementing these boundary checks, the kernel adheres to secure coding practices recommended by industry standards such as CWE-20 Improper Input Validation, thereby mitigating risks associated with malformed hardware description tables.
Security practitioners should ensure that systems running affected Linux kernels are updated to versions containing this patch immediately if they rely on ACPI-based CPU hotplugging or custom firmware configurations. Additionally organizations utilizing virtualization platforms that allow guest OS interaction with host ACPI tables must verify that their hypervisor implementations properly sanitize these structures before passing them to the guest kernel, as malicious guests could potentially exploit similar parsing flaws in other contexts. Monitoring for unusual system crashes during hardware configuration changes may also serve as an indicator of attempted exploitation against unpatched systems where this validation gap remains present.