{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-97444",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-97444"
  ],
  "published": "2026-09-24T16:08:25Z",
  "summary": "ACPICA: add boundary checks in two places",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: add boundary checks in two places\n\nAdd boundary checks in acpi_ps_get_next_namestring() and\nacpi_ps_peek_opcode() to prevent out-of-bounds access.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.189",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97444"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3a8c1efc0fd3abb2d2b1254315f36db03abc88eb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c917df56b73719a2d4cee1c4ab4a6626acb95315"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4f03d84c95a51436878cd750a14f8ca37eeb3112"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/38ee32a9ace6fae8965f059b38e6e7fb27b1e7ce"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/253d7272d01db9529c79b95205c0f859ef9f4f23"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4de2cffef5e6b5b79eec8c934df582459b818228"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/bdc35754012906dbf094be104b103ca3adfef6f7"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-10-03T11:04:09Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.7,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The truncated AML that acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() over-read is the platform DSDT/SSDT stream parsed by acpi_ns_execute_table() from acpi_load_tables() in acpi_bus_init(); those bytes come from local firmware tables, not from a network protocol message.\nAC:L - A DSDT/SSDT whose namestring (AML_MULTI_NAME_PREFIX count or a run of '\\'/'^' prefixes) or final opcode sits against the AML buffer end makes acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() read past parser_state->aml_end on every acpi_load_tables() parse; the table author sets those bytes and no race is required.\nPR:N - acpi_bus_init() calls acpi_load_tables() \u2192 acpi_tb_load_namespace() \u2192 acpi_ns_load_table() \u2192 acpi_ns_execute_table() at boot with no capability check, so the OOB in acpi_ps_get_next_namestring()/acpi_ps_peek_opcode() fires on firmware AML before any user account exists.\nUI:N - acpi_load_tables() parses the DSDT/SSDT automatically during acpi_bus_init() at boot; the victim does not need to mount media, open a file, or otherwise interact.\nS:U - acpi_ns_lookup()'s ACPI_MOVE_32_TO_32 of an over-long nameseg and acpi_ps_peek_opcode()'s ACPI_GET8 over-read kernel memory adjacent to the mapped AML buffer inside the host kernel; this is not a VM escape or IOMMU bypass.\nC:H - acpi_ps_get_next_namestring() does not cap '\\'/'^' prefix walking or the AML_MULTI_NAME_PREFIX count byte, then acpi_ns_lookup() copies up to 255 four-byte namesegs via ACPI_MOVE_32_TO_32 past aml_end, so the out-of-bounds read is not limited to a few bytes.\nI:N - The demonstrated faults are heap-buffer-overflow reads (4 bytes in acpi_ns_lookup, 1\u20132 bytes in acpi_ps_peek_opcode); the patched functions only advance parser_state->aml and return a namestring pointer or opcode, and do not write past the AML buffer.\nA:H - The same over-read past the AML allocation in acpi_ns_lookup()/acpi_ps_peek_opcode() during acpi_load_tables() can touch unmapped memory and oops or panic the kernel at boot."
    }
  }
}