Skip to content
Heist/ feed
High

ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware platforms, it has already started the EC and installed the address space handler with the struct acpi_ec pointer as handler context. However, acpi_ec_setup() propagates the error without any cleanup. The caller acpi_ec_add() then frees the struct acpi_ec for non-boot instances, leaving a dangling handler context in ACPICA. Any subsequent AML evaluation that accesses an EC OpRegion field dispatches into acpi_ec_space_handler() with the freed pointer, causing a use-after-free: BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289) Write of size 8 at addr ffff88800721de38 by task init/1 Call Trace: mutex_lock (kernel/locking/mutex.c:289) acpi_ec_space_handler (drivers/acpi/ec.c:1362) acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293) acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246) acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509) acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700) acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327) acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392) Allocated by task 1: acpi_ec_alloc (drivers/acpi/ec.c:1424) acpi_ec_add (drivers/acpi/ec.c:1692) Freed by task 1: kfree (mm/slub.c:6876) acpi_ec_add (drivers/acpi/ec.c:1751) The bug triggers on reduced-hardwar

Announced Source revision 1
Original source ↗

CVE-2026-31426

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-31426

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
        "lessThan": "022d1727f33ff90b3e1775125264e3023901952e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
        "lessThan": "9c886e63b69658959633937e3acb7ca8addf7499",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
        "lessThan": "808c0f156f48d5b8ca34088cbbfba8444e606cbc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
        "lessThan": "d04c007047c88158141d9bd5eac761cdadd3782c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
        "lessThan": "be1a827e15991e874e0d5222d0ea5fdad01960fe",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
        "lessThan": "f6484cadbcaf26b5844b51bd7307a663dda48ef6",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/acpi/ec.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.7"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.7",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.168",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.131",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.80",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.21",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19.11",
        "versionType": "semver",
        "lessThanOrEqual": "6.19.*"
      },
      {
        "status": "unaffected",
        "version": "7.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/acpi/ec.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-31426

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#39872 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement