CVE-2026-80593: hwmon: (asus_atk0110) Check package count before accessing element
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (asusatk0110) Check package count before accessing element
atkecpresent() walks the management group package returned by the GGRP ACPI method and, for each sub-package, reads its first element:
id = &obj->package.elements[0]; if (id->type != ACPITYPEINTEGER)
without checking that the sub-package is non-empty. ACPICA allocates the element array with exactly package.count entries, so for a sub-package with a zero count this reads past the allocation.
The sibling function atkdebugfsggrpopen() performs the same access but skips empty packages with a package.count check first. Add the same check to atkecpresent() so a malformed firmware package cannot trigger an out-of-bounds read.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with the asus_atk0110 hardware-monitoring driver are exposed when firmware returns a malformed GGRP ACPI management-group package containing an empty sub-package.
What is required to trigger the out-of-bounds read?
The GGRP ACPI method must return a sub-package whose package count is zero. When atk_ec_present() processes that sub-package, it accesses the first element without confirming that one exists.
Is there a mitigation if the kernel update cannot be applied immediately?
The provided information identifies malformed firmware ACPI data as the trigger. No alternative configuration workaround or mitigation is provided.
How does the fix prevent the issue?
The fix adds a package-count check in atk_ec_present() before reading the first sub-package element, matching the check already used by atk_debugfs_ggrp_open().