CVE-2026-92521 - Vulnerability Details

- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root

Description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root

acpi_pci_root_add() assigns the freshly allocated root to
device->driver_data before dmar_device_add() and pci_acpi_scan_root().
Both failure paths reach the end: label where root is kfree()'d, but
only the pci_acpi_scan_root() path clears driver_data first.

When dmar_device_add() fails during a hot-add, root is freed while
device->driver_data still points at it. The ACPI core does not clear
driver_data on attach failure, so a later acpi_pci_find_root() call may
dereference this dangling pointer.

acpi_pci_root_remove() has the same problem: it frees root without
clearing device->driver_data, leaving a dangling pointer behind after
the root bridge is removed.

Move the NULL assignment to the shared end: label so every error path in
acpi_pci_root_add() clears driver_data before freeing root, and clear it
in acpi_pci_root_remove() as well, so the object is never left reachable
through driver_data after being freed.

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The kernel driver for ACPI PCI roots does not clear its driver_data pointer when a root is freed, leaving a dangling reference. If an add or removal operation fails, the pointer remains set and later calls to acpi_pci_find_root may dereference it. This use‑after‑free can corrupt kernel memory or lead to arbitrary code execution with kernel privileges, effectively creating a serious kernel exploitation vector.

Affected Systems

All Linux kernel builds that have not incorporated the commits referenced in the matrix. The CPE indicates applicability to every version of the Linux kernel, and no specific version range is provided, so any system with the vulnerable kernel is potentially impacted.

Risk and Exploitability

The EPSS score is below 1% and the CVE is not listed in the CISA KEV catalogue, suggesting low observed exploitation activity. Nevertheless, the exploitation of a kernel use‑after‑free remains a high‑severity risk: a local or firmware‑based attacker could trigger ACPI hot‑add or removal paths to create the dangling pointer and then use defined memory corruption techniques to gain kernel privileges. The vulnerability is classified under CWE‑416.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`db89b4f0dbab837d0f3de2c3e9427a8d5393afa3`	affected	< 321bb0eb1486a0d575f02e24e3f4170e408c2f51
`db89b4f0dbab837d0f3de2c3e9427a8d5393afa3`	affected	< 3c1e8a14f9d06c1ed6f3e4bd2d283a62079109e2
`db89b4f0dbab837d0f3de2c3e9427a8d5393afa3`	affected	< a285fa3780c768dcc51c76768707d099a2cc611d
`db89b4f0dbab837d0f3de2c3e9427a8d5393afa3`	affected	< 6aaf6dbf54fdfae096f3f90a79e9614e46579280
`db89b4f0dbab837d0f3de2c3e9427a8d5393afa3`	affected	< 70cf773cca30a10b4964c24520a71279c974b899
`db89b4f0dbab837d0f3de2c3e9427a8d5393afa3`	affected	< 3eee4c21931dc048ce63b86809f04e4e6f0dcad5
`db89b4f0dbab837d0f3de2c3e9427a8d5393afa3`	affected	< 6e11ac626f9f9fc3a2ed27dfa44ccbe5fb762217
`db89b4f0dbab837d0f3de2c3e9427a8d5393afa3`	affected	< 8a742141f7ab84975aa758b775567ef4740ef0cf

Linux

affected

Version	Status	Constraints
`2.6.28`	affected	—
`0`	unaffected	< 2.6.28
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[db89b4f0dbab837d0f3de2c3e9427a8d5393afa3,321bb0eb1486a0d575f02e24e3f4170e408c2f51)`	affected	code_commit	—
`[db89b4f0dbab837d0f3de2c3e9427a8d5393afa3,3c1e8a14f9d06c1ed6f3e4bd2d283a62079109e2)`	affected	code_commit	—
`[db89b4f0dbab837d0f3de2c3e9427a8d5393afa3,a285fa3780c768dcc51c76768707d099a2cc611d)`	affected	code_commit	—
`[db89b4f0dbab837d0f3de2c3e9427a8d5393afa3,6aaf6dbf54fdfae096f3f90a79e9614e46579280)`	affected	code_commit	—
`[db89b4f0dbab837d0f3de2c3e9427a8d5393afa3,70cf773cca30a10b4964c24520a71279c974b899)`	affected	code_commit	—
`[db89b4f0dbab837d0f3de2c3e9427a8d5393afa3,3eee4c21931dc048ce63b86809f04e4e6f0dcad5)`	affected	code_commit	—
`[db89b4f0dbab837d0f3de2c3e9427a8d5393afa3,6e11ac626f9f9fc3a2ed27dfa44ccbe5fb762217)`	affected	code_commit	—
`[db89b4f0dbab837d0f3de2c3e9427a8d5393afa3,8a742141f7ab84975aa758b775567ef4740ef0cf)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.28`	affected	semver	—
`[0,2.6.28)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the patch referenced in the commit logs.
If a kernel upgrade is not immediately possible, disable ACPI PCI hot‑add functionality or block ACPI events that trigger root add or removal.
Watch for kernel oops, BUG, or panic messages that reference ACPI PCI root operations, and investigate any unexpected activity.

Generated by OpenCVE AI on September 19, 2026 at 13:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/321bb0eb1486a0d575f02e24e3f4170e408c2f51
https://git.kernel.org/stable/c/3c1e8a14f9d06c1ed6f3e4bd2d283a62079109e2
https://git.kernel.org/stable/c/3eee4c21931dc048ce63b86809f04e4e6f0dcad5
https://git.kernel.org/stable/c/6aaf6dbf54fdfae096f3f90a79e9614e46579280
https://git.kernel.org/stable/c/6e11ac626f9f9fc3a2ed27dfa44ccbe5fb762217
https://git.kernel.org/stable/c/70cf773cca30a10b4964c24520a71279c974b899
https://git.kernel.org/stable/c/8a742141f7ab84975aa758b775567ef4740ef0cf
https://git.kernel.org/stable/c/a285fa3780c768dcc51c76768707d099a2cc611d

History

Sat, 19 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root acpi_pci_root_add() assigns the freshly allocated root to device->driver_data before dmar_device_add() and pci_acpi_scan_root(). Both failure paths reach the end: label where root is kfree()'d, but only the pci_acpi_scan_root() path clears driver_data first. When dmar_device_add() fails during a hot-add, root is freed while device->driver_data still points at it. The ACPI core does not clear driver_data on attach failure, so a later acpi_pci_find_root() call may dereference this dangling pointer. acpi_pci_root_remove() has the same problem: it frees root without clearing device->driver_data, leaving a dangling pointer behind after the root bridge is removed. Move the NULL assignment to the shared end: label so every error path in acpi_pci_root_add() clears driver_data before freeing root, and clear it in acpi_pci_root_remove() as well, so the object is never left reachable through driver_data after being freed.
Title		ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/321bb0eb1486a0d575f02e24e3f4170e408c2f51 https://git.kernel.org/stable/c/3c1e8a14f9d06c1ed6f3e4bd2d283a62079109e2 https://git.kernel.org/stable/c/3eee4c21931dc048ce63b86809f04e4e6f0dcad5 https://git.kernel.org/stable/c/6aaf6dbf54fdfae096f3f90a79e9614e46579280 https://git.kernel.org/stable/c/6e11ac626f9f9fc3a2ed27dfa44ccbe5fb762217 https://git.kernel.org/stable/c/70cf773cca30a10b4964c24520a71279c974b899 https://git.kernel.org/stable/c/8a742141f7ab84975aa758b775567ef4740ef0cf https://git.kernel.org/stable/c/a285fa3780c768dcc51c76768707d099a2cc611d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:10:28.144Z

Updated: 2026-09-17T16:10:28.144Z

Reserved: 2026-09-16T12:21:13.874Z

Link: CVE-2026-92521

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:55.013

Modified: 2026-09-17T17:17:55.013

Link: CVE-2026-92521

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-19T13:15:16Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object