HIGH Introduced in 2.6.32
hwmon AtkEC OOB
CVE-2026-80593
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI4.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count before accessing element atk_ec_present() walks the management group package returned by the GGRP ACPI method and, for each sub-package, reads its first element: id = &obj->package.elements[0]; if (id->type != ACPI_TYPE_INTEGER) without checking that the sub-package is non-empty. ACPICA allocates the element array with exactly package.count entries, so for a sub-package with a zero count this reads past the allocation. The sibling function atk_debugfs_ggrp_open() performs the same access but skips empty packages with a package.count check first. Add the same check to atk_ec_present() so a malformed firmware package cannot trigger an out-of-bounds read.
02KernelScan AI Analysis
Risk summary
The asus_atk0110 hwmon driver reads past the end of an ACPI package element array when firmware returns a sub-package with zero elements, exposing kernel memory to an attacker who can influence or supply malformed ACPI data. The issue is reachable only on ASUS systems with the ATK0110 ACPI device and requires privileged access to trigger or supply the malformed firmware data. The fix adds a package-count check before accessing the first element, matching the existing guard in the sibling debugfs path.
Vulnerability analysis
When the driver queries the ACPI firmware for the embedded-controller management group, it iterates over sub-packages and immediately reads the first element of each one without first confirming the sub-package contains any elements. If firmware returns a sub-package with a zero element count, the driver reads one slot past the end of the ACPICA-allocated element array, leaking a small amount of kernel heap memory. The fix adds a count check that skips empty sub-packages, mirroring the guard already present in the debugfs open path. The vulnerable code runs during driver probe on ASUS motherboards that expose the ATK0110 ACPI device; reaching it requires the matching hardware and ACPI firmware, and the malformed data originates from firmware rather than from an unprivileged runtime caller.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.32 | 5.10.261 | 2a137124664a |
| 5.15 | 2.6.32 | 5.15.212 | 459b0a0439ea |
| 6.1 | 2.6.32 | 6.1.178 | 768f20e7bb48 |
| 6.12 | 2.6.32 | 6.12.97 | 981a8a2e3773 |
| 6.18 | 2.6.32 | 6.18.40 | d8d4fa0c4f81 |
| 6.6 | 2.6.32 | 6.6.145 | 76392d35c8df |
| 7.1 | 2.6.32 | 7.1.5 | b770fcfcdced |
| mainline | 2.6.32 | 7.2 | e2735b39f044 |
| cip/4.19 | 2.6.32 | 4.19.325-cip136 | 46664e911a72 |
| cip/4.19-rt | 2.6.32 | 4.19.325-cip136-rt50 | 46664e911a72 |
| cip/4.4 | 2.6.32 | 4.4.302-cip115 | 0dac3c552701 |
| cip/4.4-rt | 2.6.32 | 4.4.302-cip115-rt63 | 0dac3c552701 |
| cip/5.10 | 2.6.32 | 5.10.263-cip76 | 2a137124664a |
| cip/5.10-rt | 2.6.32 | 5.10.268-cip77-rt34 | 2a137124664a |
| cip/6.1 | 2.6.32 | 6.1.182-cip59 | 768f20e7bb48 |
| cip/6.1-rt | 2.6.32 | 6.1.182-cip59-rt31 | 768f20e7bb48 |
| cip/6.12 | 2.6.32 | 6.12.101-cip29 | 981a8a2e3773 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Fixed in 6.1.182-cip59 |
| cip/6.1-rt | Fixed in 6.1.182-cip59-rt31 |
| cip/5.10 | Fixed in 5.10.263-cip76 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |
| cip/4.4 | Fixed in 4.4.302-cip115 |
| cip/4.4-rt | Fixed in 4.4.302-cip115-rt63 |