Cloudanix VulnDB

CVE-2026-92522

High · 7.3

CVSS

7.3

EPSS

0.1%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing check in the operating system's handling of hardware configuration records could let local programs cause crashes or leak small amounts of data.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient bounds checking when parsing MADT and _MAT records for IOAPIC entries allows incomplete headers or truncated records to be processed, resulting in out-of-bounds reads or invalid memory access in the ACPI processor hotplug path.

Why it matters to the business

Local processes on affected Linux systems may trigger kernel instability, crashes, or limited information disclosure during ACPI-driven CPU or IOAPIC hotplug operations, increasing operational risk for servers and virtualized environments that rely on dynamic hardware configuration.

How an attack unfolds

An attacker with local access crafts or supplies malformed ACPI MADT tables or _MAT objects that contain truncated IOAPIC subtables; the kernel's parser advances past an incomplete header without verifying length, leading to reads beyond allocated buffers and potential disclosure or denial of service.

How to fix it

Apply the upstream kernel commit that adds explicit validation of generic header presence, declared length containment, and full IOAPIC body size for both MADT and _MAT paths; rebuild and deploy the patched kernel across all affected distributions.

How to confirm the fix worked

Confirm kernel source contains the bounds checks for MADT subtable length and IOAPIC record size; test hotplug paths with deliberately truncated ACPI records to verify rejection; monitor for absence of related oops messages after upgrade.

Typical attack path

  1. Obtain local code execution or shell on target Linux system
  2. Prepare malicious ACPI table data or trigger hotplug path via userspace interfaces
  3. Invoke ACPI processor or IOAPIC registration code that walks MADT or _MAT
  4. Trigger out-of-bounds read through incomplete subtable lengths
  5. Observe kernel panic, oops, or memory disclosure side effects

How to detect it

Search kernel logs for ACPI or IOAPIC related oops, warnings about invalid MADT lengths, or unexpected hotplug failures; examine system call traces involving ACPI processor registration during suspected exploitation windows.

What your security team should do

  • Prioritize kernel updates on systems exposing ACPI hotplug functionality
  • Review ACPI table sources and firmware for integrity controls
  • Enable kernel hardening features such as memory tagging where available
  • Monitor vendor advisories for distribution-specific backports

The record

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both MADT and _MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generic header. The _MAT path likewise passed a generic header to the IOAPIC helper. Validate that a current record has a complete generic header, that its declared length is contained in the available record range, and that a typed IOAPIC record contains the full fixed IOAPIC body before reading its fields. Use the same relation for both MADT and _MAT provider paths.

Affected packages

Ecosystem Package Introduced Fixed