CVE-2026-97451 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel incorporates ACPICA, a reference implementation of ACPI specifications that handles Advanced Configuration and Power Interface operations within the operating system. Within this subsystem, the function acpi_ex_opcode_3A_1T_1R() is responsible for executing specific ACPI opcodes that involve three arguments, one target operand, and one return value. A critical flaw was identified in how this routine calculates truncation lengths when processing index and length parameters. Specifically, the code performs an addition of the Index and Length values to determine a boundary or size limit without verifying whether the arithmetic operation results in an integer overflow. This oversight allows for scenarios where large input values cause the sum to wrap around due to fixed-width integer limitations, resulting in a significantly smaller positive value or potentially a negative value depending on the specific implementation details of signed versus unsigned arithmetic handling in that context.
This vulnerability is classified under CWE-190, which denotes Integer Overflow or Wraparound. The core technical flaw lies in the absence of bounds checking before performing the addition operation. When an attacker can influence the Index and Length parameters passed to this ACPI opcode handler, they can craft inputs such that their sum exceeds the maximum value representable by the integer type used for calculation. In many cases involving memory copy operations, if the resulting truncated length is interpreted as a negative number due to sign extension or improper casting, it may be treated as an extremely large unsigned value when passed to functions like memcpy(). Alternatively, if the logic explicitly checks for negativity but fails to account for the wraparound leading to unexpected small positive values that exceed intended bounds, memory corruption can still occur. The primary risk is passing a negative size parameter to memcpy(), which typically expects an unsigned long or similar type, potentially causing it to interpret the bit pattern as a massive allocation request or triggering undefined behavior in the kernel space.
The operational impact of this vulnerability is severe, particularly because ACPI handlers often execute with high privileges during system initialization and runtime power management events. If exploited successfully, the integer overflow leading to an invalid memory copy operation can result in arbitrary code execution within the kernel context. This grants attackers full control over the underlying hardware and operating system, bypassing user-space security boundaries. Furthermore, even if direct code execution is not achieved, the improper memory access can lead to kernel panics or system instability, resulting in a denial of service condition for all users on the affected machine. The attack vector may be local, requiring physical access or prior compromise of a low-privilege account that triggers specific ACPI events, or potentially remote if certain network-facing services invoke these ACPI routines indirectly through exposed interfaces.
To mitigate this vulnerability, it is essential to implement robust integer overflow checks before performing arithmetic operations on user-controlled or externally influenced data. Developers should utilize safe addition functions provided by the kernel security headers, such as check_add_overflow(), which explicitly verify that the sum of two operands does not exceed the maximum value for the target type. Additionally, input validation mechanisms must be strengthened to ensure that Index and Length parameters fall within expected ranges before any arithmetic is performed on them. Regular static analysis using tools configured with CWE-190 rules can help identify similar patterns in other parts of the ACPICA codebase. System administrators should apply kernel updates provided by their distribution vendors, as these patches include the necessary overflow checks to prevent negative size parameters from reaching memory manipulation functions like memcpy(). Adhering to secure coding practices that assume all external inputs are malicious is crucial for maintaining the integrity of low-level system components.