Cloudanix VulnDB

CVE-2026-93132

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in the startup routine for certain RISC-V computers could cause hardware setup information to be skipped, potentially preventing devices from working correctly.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerable loop in riscv_acpi_add_prt_dep() mishandles error paths by issuing continue without advancing the entry pointer, causing skipped ACPI PRT dependency entries or incorrect pointer state during RISC-V platform initialization.

Why it matters to the business

Systems running affected kernels on RISC-V hardware may experience boot-time ACPI misconfiguration, leading to missing interrupt routing, device enumeration failures, or kernel instability that disrupts server or embedded deployments.

How an attack unfolds

An attacker with the ability to influence ACPI tables or trigger repeated platform initialization on a vulnerable RISC-V system can cause the loop to skip dependency entries, resulting in incomplete hardware setup that may be leveraged for denial of service or to reach other kernel code paths in an inconsistent state.

How to fix it

Update to a Linux kernel containing the rewritten for-loop version of riscv_acpi_add_prt_dep() that correctly advances the entry pointer on all paths; rebuild and deploy the fixed kernel across all RISC-V systems.

How to confirm the fix worked

Confirm the presence of the corrected for-loop implementation and helper-function wrappers in the ACPI RISC-V source; boot test on representative RISC-V hardware while monitoring for complete PRT dependency registration in kernel logs.

Typical attack path

  1. Supply or modify ACPI tables presented to the RISC-V kernel during boot
  2. Trigger riscv_acpi_add_prt_dep() execution with entries that hit the error-continue path
  3. Observe skipped pointer updates leading to incomplete PRT dependency registration
  4. Exploit resulting misconfigured interrupt routing or platform state

How to detect it

Examine kernel boot logs and dmesg for ACPI RISC-V messages around PRT dependency processing; look for repeated or truncated dependency entries that indicate the original loop behavior was active.

What your security team should do

  • Prioritize kernel upgrade on all RISC-V production systems within the next maintenance window
  • Add the fixed kernel version to internal golden image and CI build pipelines
  • Review any downstream RISC-V distributions or embedded products for the same loop pattern

The record

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling The loop in riscv_acpi_add_prt_dep() includes error conditions that are handled in a dubious - if not outright wrong - way, by continuining the loop (which skips and misses the entry pointer update to point to the next entry). Rewrite the loop as a for loop (that handles the continuation correctly) and wrap the condition and update statements using helper functions to make it cleaner.

Affected packages

Ecosystem Package Introduced Fixed