acpica ObjectRef Corruption

Vulnerability analysis

The ACPICA object-copy routine unconditionally increments the reference count of a referenced object when duplicating ACPI reference objects, but for local, argument, and debug reference types the internal object pointer is not valid for this operation. Incrementing a reference count through an invalid or non-reference-counted pointer can corrupt kernel memory or crash the system. The fix skips the reference count increment for these three reference classes, only adding references when the pointer genuinely points to a reference-counted ACPI object. This code path is reached during ACPI control method execution, which processes ACPI tables supplied by firmware or loaded at boot — an attacker would need either root privileges to load custom ACPI tables via the table upgrade mechanism or physical access to modify the platform firmware.