acpica ResourceWalk OOB

Vulnerability analysis

The kernel's ACPI resource parser did not check that enough data remained in a buffer before reading resource descriptors, and it did not verify that a descriptor's claimed size fit within the buffer. A crafted ACPI table with malformed resource entries could therefore cause the kernel to read past the end of the allocated memory, leaking kernel data or crashing the system. The fix adds checks that ensure the parser validates remaining space before accessing descriptor headers and confirms each descriptor fits inside the buffer before continuing. The bug is triggered when the kernel parses ACPI resource templates supplied by firmware or loaded through table overrides by a privileged user.