CVE-2026-97449 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Add package limit checks in parser functions
Add package limit checks in parser functions to prevent out-of-bounds access.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The Advanced Configuration and Power Interface (ACPI) specification provides a standardized interface for operating systems to discover hardware configuration, manage power states, and interact with firmware components on modern computing platforms. The ACPI Component Architecture (ACPICA) serves as the reference implementation of this specification within the Linux kernel, handling the parsing and interpretation of ACPI tables which are critical for system initialization and runtime management. A recent resolution addresses a significant security flaw located within the parser functions responsible for processing ACPI package objects. These packages are complex data structures used to represent lists or arrays of other ACPI objects, such as integers, strings, buffers, or nested packages themselves. The vulnerability stems from insufficient validation logic when parsing these hierarchical structures, specifically regarding the limits imposed on the depth and size of nested packages during the interpretation phase.
The technical flaw involves a lack of rigorous boundary checks that prevent out-of-bounds memory access when processing deeply nested or excessively large ACPI package definitions found in firmware tables. When the ACPICA parser encounters a package object, it must recursively process its elements to build an internal representation usable by the kernel. Without adequate limit checks, maliciously crafted or malformed ACPI tables could trigger infinite recursion or excessive memory allocation, leading to stack overflow conditions or heap corruption. This type of vulnerability is classified under CWE-120 Buffer Overflow and CWE-787 Out-of-bounds Write, as it allows an attacker who can influence the content of ACPI tables to potentially execute arbitrary code or cause a denial of service by crashing the kernel. The absence of these checks represents a failure in input validation at a low-level system component that is often trusted implicitly due to its role in hardware abstraction.
From an operational perspective, this vulnerability poses a severe risk because ACPI tables are typically loaded during early boot processes and can be modified through various attack vectors depending on the deployment environment. In virtualized environments or systems with removable firmware interfaces, attackers may inject malicious ACPI tables that exploit these parsing weaknesses to gain kernel-level privileges. The impact ranges from system instability and crashes due to memory corruption to full remote code execution if an attacker can control the input source of the ACPI data. This aligns with MITRE ATT&CK techniques related to persistence via bootkit mechanisms or privilege escalation through firmware exploitation, highlighting the critical nature of securing low-level interfaces that bridge hardware and operating systems.
Mitigation strategies primarily involve applying the kernel patch that introduces strict package limit checks within the ACPICA parser functions. System administrators should ensure their Linux kernels are updated to versions containing this fix to prevent potential exploitation. Additionally, organizations relying on custom or third-party firmware should validate ACPI tables for compliance with the specification and check for anomalies in structure depth and size before deployment. Implementing secure boot mechanisms can also help mitigate risks by ensuring that only signed and verified firmware components are loaded during system initialization, thereby reducing the attack surface available to adversaries attempting to inject malicious ACPI data into the parsing pipeline.