UBUNTU-CVE-2026-89587: Buffer Overflow
In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability() querycapability() copies four ACPI buffer objects returned by the firmware DSM into fixed-size u8[16] fields in struct pfruupdatecapinfo using memcpy with the firmware-supplied length: memcpy(&caphdr->codetype, elements[CAPCODETYPEIDX].buffer.pointer, elements[CAPCODETYPEIDX].buffer.length); The same pattern repeats for drvtype, platformid, and oemid. If the firmware returns buffer.length > 16 for any of these fields, memcpy writes past the destination array. struct pfruupdatecapinfo is stack-allocated in pfruioctl(). Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports are generated when a DSM returns 64-byte buffers, with writes reaching 44 bytes past the end of caphdr's [64, 156) frame window into adjacent stack redzones. Introduce a helper pointer to outobj->package.elements and use it to validate each buffer length against its destination field size before copying, returning -EINVAL if the firmware supplies an oversized buffer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In query_capability(), validate each firmware-returned ACPI buffer length against the destination field size before memcpy; reject any oversized buffer by returning -EINVAL. Apply this to code_type, drv_type, platform_id, and oem_id, whose destination fields are u8[16].
Event History
Frequently Asked Questions
What conditions are required to trigger the overflow?
The affected ACPI firmware _DSM must return an oversized buffer, greater than 16 bytes, for one of the code type, driver type, platform ID, or OEM ID capability fields. Exploitation also requires local privileges, as reflected by the PR:L attack vector.
Which systems are most likely exposed?
Systems running one of the listed Ubuntu kernel packages may be affected when their platform firmware exposes the relevant ACPI PFR update _DSM interface and returns oversized capability buffers. The provided data does not identify particular hardware models or firmware versions.
What happens when the vulnerable code receives an oversized field?
The kernel copies the firmware-provided length into a fixed 16-byte stack field without checking its size, causing a stack buffer overflow. Testing with 64-byte buffers produced stack out-of-bounds writes reaching 44 bytes beyond the relevant stack-frame window.
How does the fix handle malformed firmware responses?
The fix validates each returned ACPI buffer length against the size of its destination field before copying. If firmware supplies an oversized buffer, the operation fails with -EINVAL rather than performing the copy.