Look up another CVE · open CVE-2026-97448 in the interactive tracker
CVE-2026-97448
ACPICA: Add validation for node in acpi_ns_build_normalized_path()
Published 2026-09-24 (24 days ago) by the Linux kernel CNA. Subsystem drivers/acpi. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-97448 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Add validation for node in acpi_ns_build_normalized_path() to prevent use-after-free vulnerabilities.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/acpi/acpica/nsnames.c
- What this is
- ACPI COMPONENT ARCHITECTURE (ACPICA)MAINTAINERS section matched on drivers/acpi/acpica/ · linux-acpi@vger.kernel.org · Supported
Check it on the machine
grep -w CONFIG_ACPI /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormYnot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le
- trixieYnot built on armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- forky, sidYnot built on armhf/armmp, armhf/armmp-lpae, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- bookworm · linux-6.12Ynot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- Y
- built in where it is built at all; some flavours do not build it
- Build switch
- CONFIG_ACPI
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-24 (24 days ago)source
- CVSS
- 7.7 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/acpi
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.3 | 5.10.271 | 087eed8b347e |
| 4.3 | 5.15.222 | b06bb9b82c8f |
| 4.3 | 6.1.189 | 90ebe7f8bb6c |
| 4.3 | 6.6.158 | 26dd27000e95 |
| 4.3 | 6.12.111 | babb146ceb79 |
| 4.3 | 6.18.53 | 21a73528579f |
| 4.3 | 7.2 | 96b2b616870e |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The stale node that acpi_ns_build_normalized_path() walks is produced while executing attacker-supplied DSDT/SSDT AML: acpi_bus_init()→acpi_load_tables()→acpi_tb_load_namespace()→acpi_ns_load_table()→acpi_ns_execute_table()→acpi_ps_parse_aml()→acpi_ds_terminate_control_method()→acpi_ex_stop_trace_method()→acpi_ns_get_normalized_pathname(); those table bytes come from platform firmware, not a network protocol.
- AC:LAttack complexity, low
- ACPICA issue #1138 reproduces a deterministic heap-use-after-free: acpi_ps_parse_aml() frees a walk_state via acpi_ds_delete_walk_state(), then acpi_ds_terminate_control_method() calls acpi_ex_stop_trace_method() which always invokes acpi_ns_get_normalized_pathname() on method_desc->method.node; crafted AML (issue33.aml) makes that pointer alias the freed walk_state with no race.
- PR:NPrivileges required, none
- acpi_bus_init() calls acpi_load_tables() at boot with no capable() or credential check, so module-level AML in a compromised DSDT/SSDT reaches acpi_ex_stop_trace_method()→acpi_ns_build_normalized_path() inside acpi_ns_execute_table() before any Linux account exists.
- UI:NUser interaction, none
- acpi_ns_execute_table() evaluates the DSDT/SSDT as a module-level method during acpi_load_tables() on ordinary power-on; the terminate-path UAF fires without a victim mount, sysfs open, or configfs SSDT write.
- S:UScope, unchanged
- The use-after-free is ACPI_MOVE_32_TO_32 of next_node->name inside a freed host-kernel acpi_walk_state in acpi_ns_build_normalized_path(); it does not cross a KVM/Xen, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- acpi_ns_build_normalized_path() reads 4-byte namesegs and follows next_node->parent on the freed 1176-byte walk_state (ASAN: heap-use-after-free READ of size 4 at the ACPI_MOVE_32_TO_32 of next_node->name); after slab reuse that parent walk is an unbounded kernel-heap read, not a few header bytes.
- I:NIntegrity impact, none
- The UAF is a read of next_node->name and next_node->parent; ACPI_PATH_PUT8 only writes into the separately allocated pathname buffer from acpi_ns_get_normalized_pathname(), and acpi_ex_stop_trace_method() then ACPI_FREE()s that buffer, so there is no write through the freed walk_state.
- A:HAvailability impact, high
- The reported AddressSanitizer heap-use-after-free in AcpiNsBuildNormalizedPath during AcpiLoadTables/acpi_ns_execute_table oopses the kernel at boot, and a cyclic parent pointer in the reclaimed walk_state can also hang the while (next_node && next_node != acpi_gbl_root_node) loop.