CVE-2023-52519

What it actually does

The flaw causes an ACPI GPE reference count overflow because BIOS clears the wakeup bit on resume without decrementing the OS count, and the driver re-enables it via acpi_disable_gpe followed by re-enable on every resume from S5 on Intel Elkhart Lake platforms.

Why it matters to the business

Affected Linux systems on EHL hardware can experience repeated kernel instability or crashes after many suspend/resume cycles, increasing operational downtime risk on servers and workstations even though public exploit activity remains low.

How an attack unfolds

An attacker with local access forces repeated entry and exit from S5 soft-off state; each cycle triggers the driver to re-enable the GPE without a matching decrement, driving the reference counter to overflow and corrupt adjacent kernel memory.

How to fix it

Apply the upstream fix present in commit 8781fe259dd5a178fdd1069401bbd1437f9491c5; rebuild and deploy kernels containing this change to all affected stable branches.

How to confirm the fix worked

Confirm the running kernel tree contains commit 8781fe259dd5a178fdd1069401bbd1437f9491c5, then exercise S5 resume paths on EHL hardware while monitoring GPE reference counts for expected behavior.

Typical attack path

1. Obtain local shell or userland execution on the target system
2. Trigger multiple suspend-to-S5 and resume sequences
3. Induce reference count overflow and subsequent memory corruption
4. Escalate to kernel panic or denial of service

How to detect it

Review kernel logs for repeated acpi_gpe enable/disable messages around resume events and any associated reference count warnings or panics; correlate with high-frequency S5 transitions on EHL hardware.

What your security team should do

• Prioritize kernel updates containing 8781fe259dd5a178fdd1069401bbd1437f9491c5 across all Linux fleets
• Schedule testing of suspend/resume on Intel Elkhart Lake platforms before broad rollout
• Add kernel oops and GPE-related panic alerts to existing monitoring