HIGH Introduced in 2.6.12
acpica MidOp Overflow
CVE-2026-97451
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy().
02KernelScan AI Analysis
Risk summary
An integer overflow in the ACPI interpreter's Mid operation allows a crafted ACPI table to bypass a bounds check, causing an out-of-bounds memory write via memcpy. An attacker needs physical access to modify firmware ACPI tables or root privileges to load custom tables at runtime.
Vulnerability analysis
The ACPI interpreter's string and buffer truncation operation can be tricked into skipping a bounds check when the position and length operands overflow. Without the overflow check, the interpreter uses the unsanitized length in a memory copy, writing far past the end of the target buffer. The fix adds a wraparound test so that any request whose computed endpoint overflows is clamped to the actual buffer size. This code is reached only when the kernel evaluates ACPI machine language from firmware-supplied tables, so an attacker must either modify the device's firmware or bootloader configuration, or supply a custom table at runtime with root privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.12 | 5.10.271 | 6da963ed4c3d |
| 5.15 | 2.6.12 | 5.15.222 | e539003886b3 |
| 6.1 | 2.6.12 | 6.1.189 | 9010ad440f97 |
| 6.6 | 2.6.12 | 6.6.158 | 4532c9cf006b |
| 6.12 | 2.6.12 | 6.12.111 | d0d89f2e16a8 |
| 6.18 | 2.6.12 | 6.18.53 | b96401812cbf |
| mainline | 2.6.12 | 7.2 | 0e2021f49e64 |
| cip/6.12 | 2.6.12 | 6.12.111-cip32 | d0d89f2e16a8 |