HIGH Introduced in 4.0
acpi MadtEntry OOB
CVE-2026-92522
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
KernelScan AI4.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both MADT and _MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generic header. The _MAT path likewise passed a generic header to the IOAPIC helper. Validate that a current record has a complete generic header, that its declared length is contained in the available record range, and that a typed IOAPIC record contains the full fixed IOAPIC body before reading its fields. Use the same relation for both MADT and _MAT provider paths.
02KernelScan AI Analysis
Risk summary
The ACPI IOAPIC hotplug parser reads subtable fields without validating that records are fully contained within the table buffer, allowing malformed ACPI tables to trigger out-of-bounds reads that can panic the kernel. Exploitation requires supplying crafted ACPI tables, which needs either physical access to flash firmware or root privileges to modify boot configuration. Systems with verified boot and locked-down kernels are protected against tampered ACPI tables.
Vulnerability analysis
The ACPI processor's IOAPIC hotplug parser walks firmware-provided tables to locate IOAPIC entries. It previously trusted each record's own length value to advance through the buffer without confirming that length stayed within the table's actual bounds, and it read IOAPIC entry bodies without first checking that the full entry fit inside the remaining buffer. The fix now verifies that every record has a complete header, that its claimed size does not exceed the remaining table space, and that an entire IOAPIC entry is present before reading any of its fields, applying the same checks to both firmware table sources. An attacker can trigger this only by supplying malformed ACPI tables, which requires either physical access to modify firmware or root privileges to change boot configuration or load table overlays.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.0 | 5.10.270 | 5601bd81bc29 |
| 5.15 | 4.0 | 5.15.221 | ff82e3374e91 |
| 6.1 | 4.0 | 6.1.188 | 2a5520065e76 |
| 6.12 | 4.0 | 6.12.110 | 74d84320f8e3 |
| 6.18 | 4.0 | 6.18.52 | 4d8ecaa332c1 |
| 7.2 | 4.0 | 7.2.6 | 355bee5f11ac |
| mainline | 4.0 | 7.3-rc1 | 2c50ffdc73f3 |
| 6.6 | 4.0 | 6.6.157 | 8e67b58c0499 |
| cip/6.12 | 4.0 | 6.12.111-cip32 | 74d84320f8e3 |