CVE-2026-80593

CVE-2026-80593 is an out-of-bounds read in atk_ec_present() in the Linux kernel's asus_atk0110 hardware-monitoring driver: the function walks the management group package returned by the GGRP ACPI method and reads the first element of each sub-package without first checking that the sub-package is non-empty. Because ACPICA allocates the element array with exactly package.count entries, a sub-package with a zero count causes the driver to read past the end of the allocation. The condition is reached when system firmware supplies a malformed (empty) management group package; per the CVSS vector (AV:L/AC:L/PR:N/UI:N) only local, unprivileged access is required, with high rated impact to confidentiality, integrity, and availability. Only systems running Linux kernels with the asus_atk0110 driver loaded — i.e., ASUS hardware exposing the legacy ATK0110 ACPI interface — are affected. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known; EPSS estimates about a 0.1% probability of exploitation within 30 days.

What to do: Install a kernel update once your distribution ships a backport of the fix (the patch adds the same package.count check to atk_ec_present() that atk_debugfs_ggrp_open() already performs); no fixed version numbers are given in the advisory, so track your vendor's kernel advisory. Check whether the driver is actually in use with 'lsmod | grep asus_atk0110' or by looking for the ATK0110 ACPI device in the DSDT — if absent, your systems are not affected. There is no user-side mitigation beyond patching, since the trigger is malformed firmware-provided ACPI data.