acpica NextField OOB

Vulnerability analysis

The ACPI Machine Language parser reads field type bytes, four-character name segments, and access attribute bytes from an AML bytecode buffer without first verifying that sufficient data remains before each read. A truncated or malformed ACPI table can drive the parser past the end of the buffer, causing out-of-bounds reads that may access unmapped memory and panic the kernel, or expose small fragments of adjacent kernel memory. The fix adds explicit bounds checks at each read point in the field-parsing loop, returning an error immediately when the buffer end is reached so no data is consumed beyond it. The vulnerable parser is reached when the kernel processes ACPI tables supplied by firmware at boot or loaded at runtime by a privileged user, so an attacker needs either physical access to modify boot or firmware configuration, or root-level privileges to load custom ACPI tables through debugfs or configfs interfaces.