CVE-2026-93251 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
ACPI: bus: Introduce acpi_bus_get_primary_device()
The function used for obtaining the first "physical" device for which the given ACPI one is the ACPI companion, acpi_get_first_physical_node(), may return a stale device pointer (mostly in theory) because acpi_unbind_one() may run as a whole after dropping the ACPI device's physical_node_lock in acpi_get_first_physical_node() and before it returns. The last reference to the "physical" device may be dropped then before the pointer to it is returned to the caller.
If that happens and the acpi_get_first_physical_node() caller invokes get_device() on the pointer obtained from it, which is done by the majority of its callers, a use-after-free will occur.
To prepare for addressing this problem, introduce a new function for getting the first "physical" device associated with the given ACPI one (the "primary physical device") that will also reference count the device in question before returning a pointer to it.
Make that new function and acpi_get_first_physical_node() share the physical node list lookup code.
No intentional functional impact.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel's Advanced Configuration and Power Interface subsystem contains a race condition within the mechanism used to retrieve primary physical devices associated with ACPI entities, specifically involving the function acpi_get_first_physical_node(). This vulnerability arises from an improper handling of reference counting and locking during device enumeration operations. The core issue lies in the sequence where the function releases the physical node lock before returning the pointer to the caller. In a concurrent execution environment, this window allows another thread or process to invoke acpi_unbind_one(), which may drop the last reference to the targeted physical device. Consequently, by the time the original caller receives the pointer and attempts to use it, the underlying memory structure may have already been freed, leading to a classic use-after-free condition.
This flaw is particularly dangerous because most callers of this function immediately invoke get_device() on the returned pointer to increment its reference count before proceeding with further operations. When the device has already been unbound and released in the interim window, calling get_device() operates on invalid memory. This scenario can lead to kernel panics, data corruption, or potentially arbitrary code execution if an attacker can influence the timing of these concurrent events. Although the description notes no intentional functional impact under normal single-threaded conditions, the theoretical possibility of this race condition represents a significant stability and security risk in multi-core systems where ACPI device binding and unbinding occur frequently during hotplug operations or power state transitions.
From a vulnerability classification perspective, this issue aligns with CWE-416, Use After Free, as it involves accessing memory after it has been made available for reuse without proper synchronization. In the context of the MITRE ATT&CK framework, such vulnerabilities are often exploited in conjunction with privilege escalation techniques where an attacker might leverage kernel memory corruption to gain higher levels of system access or disrupt service availability through denial-of-service attacks targeting critical subsystems like ACPI management. The lack of atomic reference counting during the retrieval process is a common pattern in older kernel code that requires careful review when dealing with shared resources and dynamic device lifecycles.
To mitigate this vulnerability, developers introduced a new function named acpi_bus_get_primary_device(). This updated approach ensures that the reference count for the physical device is incremented before the pointer is returned to the caller, thereby preventing the use-after-free scenario even if unbinding occurs concurrently. The implementation shares the underlying logic for looking up the physical node list with the original function to maintain consistency and reduce code duplication while enforcing stricter synchronization rules. This change effectively closes the race window by guaranteeing that any device pointer handed out remains valid for at least as long as the caller holds a reference, adhering to standard kernel memory safety practices. System administrators should ensure their kernels are updated to include this fix to prevent potential instability or security breaches related ACPI device management operations.