Linux kernel ACPI Platform Firmware Runtime Update: firmware-supplied length overflows a stack buffer

Impact

query_capability() memcpy's four ACPI buffer objects returned by the firmware _DSM into fixed u8[16] fields of a stack-allocated struct pfru_update_cap_info, using the firmware-supplied length without checking it. Firmware returning more than 16 bytes for code_type, drv_type, platform_id or oem_id writes past the destination array; KASAN on 7.2-rc6 shows three stack-out-of-bounds reports with writes reaching 44 bytes past the end of the frame window into adjacent redzones. This is the runtime firmware update path on platforms that support it, so the trust boundary at stake is exactly the one an operator relies on when applying microcode or platform firmware without a reboot. Exploitation requires firmware that returns oversized buffers, so the realistic threat is already-tampered or simply buggy platform firmware turning a firmware-update operation into kernel stack corruption.

Who can reach it

Local, via the pfru ioctl, combined with platform firmware that returns oversized _DSM buffers. The ioctl is administrative and the firmware side must misbehave, so this is not reachable by a tenant workload on a machine with sound firmware.

What to do

Apply the stable kernel update, which validates each buffer length against its destination field size and returns -EINVAL on an oversized buffer, and reboot the node. No firmware flash is required - the fix is entirely on the kernel side. Nodes without ACPI Platform Firmware Runtime Update support are not exposed. The record gives four stable commits and no fixed release numbers.

References

Related entries

• Linux kernel APEI GHES: wrong sizeof lets ARM error-record parsing read past the CPER sectionCVE-2026-89588 · Linux kernel ACPI APEI GHES (ARM processor CPER section length accounting)Unscored
• Linux kernel RDMA/counter: failed QP bind leaks the port counter count and wedges counter modeCVE-2026-97477 · Linux kernel RDMA/counter (num_counters leak in alloc_and_bind() error path)Unscored
• Linux kernel hfi1: PIO credit-return mmap installs a bad pfn and oopses the nodeCVE-2026-98216 · Linux kernel IB/hfi1 (PIO_CRED credit-return mmap)Unscored
• Linux kernel RDMA/ucma: race between concurrent multicast join and leave frees in-use stateCVE-2026-98253 · Linux kernel RDMA/ucma (multicast join/leave serialization)Unscored
• Linux kernel RDS/IB: protocol version mismatch deadlocks the RDS connection workqueuesCVE-2026-98257 · Linux kernel RDS over InfiniBand (rds_ib_cm_connect_complete)Unscored
• Linux kernel RDMA/siw: out-of-bounds write from fragmented DDP/RDMAP header copiesCVE-2026-98323 · Linux kernel RDMA/siw (software iWARP DDP/RDMAP header parsing)Unscored