CVE-2026-97445

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Malformed AML resource bytes arrive in a Buffer from DSDT/SSDT, not a network message. acpi_ut_walk_aml_resources() is reached from acpi_ex_concat_template() during acpi_bus_init→acpi_load_tables→acpi_ns_load_table (ConcatenateResTemplate) and from acpi_rs_create_resource_list() via acpi_dev_get_resources() on _CRS; both are local firmware paths.

AC:LAttack complexity, low

A Buffer whose remaining length is below sizeof(aml_resource_end_tag), a large descriptor shorter than the serial_bus.type field, or a 16-bit Resource Length larger than end_aml-aml makes acpi_ut_validate_resource() and acpi_rs_convert_aml_to_resources() over-read on every walk; the table author sets those bytes and no race is required.

PR:NPrivileges required, none

acpi_bus_init() calls acpi_load_tables() which executes module-level ConcatenateResTemplate, and acpi_dev_get_resources() walks _CRS during scan, neither with a uid or capability check; a compromised DSDT/SSDT is enough with no local account.

UI:NUser interaction, none

acpi_ns_execute_table() evaluates module-level AML during acpi_load_tables(), and acpi_scan_claim_resources()/acpi_dev_get_resources() walk _CRS while claiming device resources; both run on ordinary power-on with no mount, file-open, or other victim action.

S:UScope, unchanged

The over-read is of kernel heap adjacent to the ACPI Buffer object's payload (acpi_ut_create_buffer_object) inside the host ACPICA interpreter; it does not cross a KVM/Xen, IOMMU, or sandbox boundary.

C:HConfidentiality impact, high

Without the length>(end_aml-aml) check, a large vendor/GPIO/serial descriptor whose 16-bit Resource Length exceeds the remaining Buffer lets acpi_rs_convert_aml_to_resource() ACPI_RSC_MOVE*/COUNT16 copy up to that claimed length from past the heap allocation, an unbounded kernel overread rather than a few header bytes.

I:NIntegrity impact, none

AddressSanitizer and the patch comments describe a READ past the AML Buffer; acpi_ut_walk_aml_resources() only validates and optionally converts into a separately sized resource list, and ConcatenateResTemplate (user_function NULL) never stores through the over-read pointer, so there is no out-of-bounds write primitive.

A:HAvailability impact, high

acpi_ut_validate_resource() reading common_serial_bus.type or acpi_rs_move_data() copying a claimed Resource Length past the Buffer object walks off the slab allocation and can oops/panic, matching the reported KASAN heap-buffer-overflow in AcpiUtValidateResource on the ConcatenateResTemplate path.