UBUNTU-CVE-2026-100072: High severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpibusgetprimarydevice() The acpigetfirstphysicalnode() usage in acpiplatformfillresource() and acpicreateplatformdevice() is generally unsafe because in theory the device returned by it may be freed at any time [1]. It is also inefficient because acpigetfirstphysicalnode() is called multiple times for the same argument which can be avoided. Address these issues by using acpibusgetprimarydevice() instead of acpigetfirstphysicalnode() and adjusting the code to call it just once at the beginning of and acpicreateplatformdevice() and drop the device reference acquired by it upon the return from that function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel ACPI platform code, replace acpi_get_first_physical_node() with acpi_bus_get_primary_device(); call acpi_bus_get_primary_device() only once at the beginning of acpi_create_platform_device(), and drop the device reference it acquires when that function returns.