CVE-2026-89436

platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]

acpi_pcc_retrieve_biosdata() rejects SINF packages only when
pcc->num_sifr is strictly less than hkey->package.count, then
unconditionally writes a trailing sentinel at
pcc->sinf[hkey->package.count]. But pcc->sinf[] is allocated with
exactly pcc->num_sifr elements (valid indices 0..num_sifr-1), so that
write needs num_sifr strictly greater than package.count to stay in
bounds -- num_sifr == package.count passes the existing check but
still overflows by one element.

This is exactly the case probe()'s existing num_sifr++ workaround
("Some DSDT-s have an off-by-one bug where the SINF package count is
one higher than the SQTY reported value") is written to accommodate:
when a DSDT's SINF package count equals SQTY+1, the workaround makes
num_sifr equal to package.count, which is precisely the boundary that
overflows here. Found via UBSan (array-index-out-of-bounds) on
hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38
elements: num_sifr becomes 38 after the += 1 workaround, the loop
correctly fills indices 0..37, and the sentinel write then targets
index 38, one past the end -- a silent 4-byte heap overflow on kernels
without CONFIG_UBSAN.

Tightening the rejection check to num_sifr <= package.count would
avoid the overflow but breaks probe() entirely on exactly this
hardware, since num_sifr == package.count is the case the off-by-one
workaround exists to support. Nothing else in the driver reads this
sentinel value back, so simply skip the write when there is no room
for it instead.

Analysis

Technical impact

The Linux kernel platform/x86 panasonic‑laptop driver performs a sentinel write beyond the bounds of the pcc->sinf array, an out‑of‑bounds write identified as CWE‑787. This silent 4‑byte heap overflow corrupts kernel memory during ACPI table parsing when a malicious or malformed SINF package is processed.

Affected Systems

All Linux kernel releases that include the platform/x86 panasonic‑laptop driver before the commit that removes the off‑by‑one sentinel write are affected. The vulnerability is triggered when the kernel uses the num_sifr++ workaround to accommodate DSDT off‑by‑one bugs, which makes the array bounds check vulnerable. Systems running on Panasonic laptops or any hosts that load this driver and have not applied the patch are at risk.

Risk and Exploitability

The CVSS base score of 7.8 classifies this as high severity. The EPSS score of <1% and absence from CISA KEV suggest a low exploitation probability at present. Based on the description, it is inferred that exploitation requires local access to supply a malicious ACPI or DSDT table that the panasonic‑laptop driver will parse, typically demanding firmware control or physical manipulation. A successful trigger would cause silent 4‑byte kernel heap corruption with undefined consequences.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a3d0dbd18ce908292607bb6cf37c978ece8a33d4`	affected	< a93df956ee4d903735b6d395362c839cb1dc07e3
`a3d0dbd18ce908292607bb6cf37c978ece8a33d4`	affected	< 329f10d8be193bf36af124e00b9dd6644cd71724

Linux

affected

Version	Status	Constraints
`7.2`	affected	—
`0`	unaffected	< 7.2
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[a3d0dbd18ce908292607bb6cf37c978ece8a33d4,a93df956ee4d903735b6d395362c839cb1dc07e3)`	affected	code_commit	—
`[a3d0dbd18ce908292607bb6cf37c978ece8a33d4,329f10d8be193bf36af124e00b9dd6644cd71724)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.2`	affected	generic	—
`[0,7.2)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a release that contains the CVE‑2026‑89436 fix.
If an updated kernel cannot be installed, disable the panasonic‑laptop driver or prevent the execution of untrusted ACPI tables.
Monitor kernel or kernel crashes.

Generated by OpenCVE AI on September 21, 2026 at 01:33 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.178% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/329f10d8be193bf36af124e00b9dd6644cd71724
https://git.kernel.org/stable/c/a93df956ee4d903735b6d395362c839cb1dc07e3
https://nvd.nist.gov/vuln/detail/CVE-2026-89436
https://www.cve.org/CVERecord?id=CVE-2026-89436

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89436 https://www.cve.org/CVERecord?id=CVE-2026-89436
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] acpi_pcc_retrieve_biosdata() rejects SINF packages only when pcc->num_sifr is strictly less than hkey->package.count, then unconditionally writes a trailing sentinel at pcc->sinf[hkey->package.count]. But pcc->sinf[] is allocated with exactly pcc->num_sifr elements (valid indices 0..num_sifr-1), so that write needs num_sifr strictly greater than package.count to stay in bounds -- num_sifr == package.count passes the existing check but still overflows by one element. This is exactly the case probe()'s existing num_sifr++ workaround ("Some DSDT-s have an off-by-one bug where the SINF package count is one higher than the SQTY reported value") is written to accommodate: when a DSDT's SINF package count equals SQTY+1, the workaround makes num_sifr equal to package.count, which is precisely the boundary that overflows here. Found via UBSan (array-index-out-of-bounds) on hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38 elements: num_sifr becomes 38 after the += 1 workaround, the loop correctly fills indices 0..37, and the sentinel write then targets index 38, one past the end -- a silent 4-byte heap overflow on kernels without CONFIG_UBSAN. Tightening the rejection check to num_sifr <= package.count would avoid the overflow but breaks probe() entirely on exactly this hardware, since num_sifr == package.count is the case the off-by-one workaround exists to support. Nothing else in the driver reads this sentinel value back, so simply skip the write when there is no room for it instead.
Title		platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/329f10d8be193bf36af124e00b9dd6644cd71724 https://git.kernel.org/stable/c/a93df956ee4d903735b6d395362c839cb1dc07e3