acpica HandlerObject Corruption

Vulnerability analysis

The ACPI event handler code walks linked lists of handler objects without verifying that each object is actually an address-handler type before accessing handler-specific fields. If a non-handler object ends up on such a list — for example through malformed ACPI tables supplied by firmware or loaded as an override — the code misinterprets the object's memory layout, reading and comparing fields at incorrect offsets, and potentially returning a wrong-type object to callers that then use it as a handler. The fix adds a type check at the start of each list-walk loop, breaking out immediately if the object is not the expected address-handler type. The vulnerable code path is reached during ACPI initialization and address-space handler setup, which processes ACPI tables from firmware at boot or from root-supplied table overrides; it is not reachable from the network or by unprivileged users.