CVE-2026-97451: ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix integer overflow in acpiexopcode3A1T1R() (midop)
Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add an overflow check for Index + Length in acpi_ex_opcode_3A_1T_1R() (mid_op) before calculating the truncation length, preventing a negative size parameter from being passed to memcpy().
Event History
Frequently Asked Questions
What condition triggers the unsafe copy operation?
The vulnerable path is reached when the ACPICA mid_op operation calculates a truncation length using Index + Length. An integer overflow in that calculation can produce a negative size parameter that is passed to memcpy().
How is this issue mitigated by the fix?
The resolved change adds an overflow check for Index + Length before calculating the truncation length. This prevents the negative memcpy size parameter caused by the overflow.