CVE-2026-100072: ACPI: platform: Use acpi_bus_get_primary_device()
In the Linux kernel, the following vulnerability has been resolved:
ACPI: platform: Use acpibusgetprimarydevice()
The acpigetfirstphysicalnode() usage in acpiplatformfillresource() and acpicreateplatformdevice() is generally unsafe because in theory the device returned by it may be freed at any time [1].
It is also inefficient because acpigetfirstphysicalnode() is called multiple times for the same argument which can be avoided.
Address these issues by using acpibusgetprimarydevice() instead of acpigetfirstphysicalnode() and adjusting the code to call it just once at the beginning of and acpicreateplatformdevice() and drop the device reference acquired by it upon the return from that function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In acpi_platform_fill_resource() and acpi_create_platform_device(), replace acpi_get_first_physical_node() with acpi_bus_get_primary_device(), call it once at the beginning rather than multiple times, and drop the device reference acquired by it before returning from acpi_create_platform_device().
Event History
Frequently Asked Questions
Which systems are relevant to this issue?
The issue affects the Linux kernel's ACPI platform-device handling path. Systems that use ACPI and create or manage ACPI-backed platform devices are the relevant scope described by the fix.
What condition leads to the unsafe behavior?
The affected code uses acpi_get_first_physical_node() in acpi_platform_fill_resource() and acpi_create_platform_device(). The device returned by that function may, in theory, be freed at any time, making its use unsafe.
How does the fix mitigate the issue?
The fix replaces acpi_get_first_physical_node() with acpi_bus_get_primary_device(), obtains the device reference once at the start of acpi_create_platform_device(), and releases that reference when the function returns. It also avoids repeated lookups for the same ACPI device.