CVE-2026-89587
largeStack buffer overflow via firmware _DSM in Linux ACPI pfr_update driver
A stack buffer overflow exists in the Linux kernel's ACPI pfr_update driver (Platform Firmware Runtime Update): query_capability() uses memcpy with firmware-supplied lengths to copy four ACPI _DSM buffer objects into fixed 16-byte fields of a stack-allocated struct pfru_update_cap_info without any bounds checking. If platform firmware returns any of these buffers longer than 16 bytes — demonstrated with 64-byte buffers on kernel 7.2-rc6, where writes ran 44 bytes past the field into adjacent stack redzones under KASAN — the kernel stack is corrupted. A local attacker with low privileges who can trigger the capability-query ioctl and influence the firmware's _DSM responses could leverage this for kernel memory corruption, yielding privilege escalation with high confidentiality, integrity, and availability impact (CVSS 3.1: 7.8, local vector). Affected systems are those running kernels that include the pfr_update driver together with firmware exposing the ACPI Platform Firmware Runtime Update interface, common on recent Intel server and client platforms — though practical exploitation additionally requires buggy or malicious firmware returning oversized buffers. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported.
What to do: Apply kernel updates that backport the query_capability() length-validation fix once your distribution ships it. As hardening, disable or block the ACPI PFRU/T driver (and its /dev/pfr_update device) on systems that do not use in-OS firmware runtime updates, and verify platform firmware provenance (vendor-signed capsules, Secure Boot) since triggering the overflow requires firmware returning oversized _DSM buffers. Monitor for unprivileged local users invoking the pfr_update ioctl if audit tooling is available.
| Linux kernel (ACPI pfr_update / Platform Firmware Runtime Update driver) | Confirmed affected on 7.2-rc6; earlier kernel releases shipping the pfr_update driver presumed affected (fix validates each _DSM buffer length against its 16-by |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: fix stack buffer overflow in query_capability() query_capability() copies four ACPI buffer objects returned by the firmware _DSM into fixed-size u8[16] fields in struct pfru_update_cap_info using memcpy with the firmware-supplied length: memcpy(&cap_hdr->code_type, elements[CAP_CODE_TYPE_IDX].buffer.pointer, elements[CAP_CODE_TYPE_IDX].buffer.length); The same pattern repeats for drv_type, platform_id, and oem_id. If the firmware returns buffer.length > 16 for any of these fields, memcpy writes past the destination array. struct pfru_update_cap_info is stack-allocated in pfru_ioctl(). Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports are generated when a DSM returns 64-byte buffers, with writes reaching 44 bytes past the end of cap_hdr's [64, 156) frame window into adjacent stack redzones. Introduce a helper pointer to out_obj->package.elements and use it to validate each buffer length against its destination field size before copying, returning -EINVAL if the firmware supplies an oversized buffer.
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.