{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-97455",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-97455"
  ],
  "published": "2026-09-24T16:08:25Z",
  "summary": "ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix use-after-free in acpi_ds_terminate_control_method()\n\nFix use-after-free issue in acpi_ds_terminate_control_method() by\nclearing references to method locals and arguments.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.189",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97455"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/460aed7b408508a2c28ca4fdd8d90a82bb4005aa"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3855d8992f5a88b033925cc4f6aef7a485f326cb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2793b1c38f0053fd9b119ce4607dd056eb05d382"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/63ca6f67816a229e07a08cac4bef1b3858abde66"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/fe7b3d3b7490c2c0119f2d84fa33996dcbc71042"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ef5a8d939c1e5b36e75450bbb5b6348faff4dcf3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/945e87267cfd90937b3c637f87324cbb56998b72"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-10-03T11:04:09Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.4,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The data that becomes walk_state->return_desc is AML RefOf(Local/Arg) in the platform DSDT/SSDT. acpi_ex_get_object_reference builds that ACPI_REFCLASS_REFOF; acpi_ps_parse_aml then calls the patched acpi_ds_terminate_control_method from acpi_ns_execute_table (acpi_load_tables) or acpi_ps_execute_method (acpi_evaluate_object). Those tables are local firmware, not a network protocol message.\nAC:L - The table author emits Return(RefOf(LocalN)) or Return(RefOf(ArgN)); acpi_ex_get_object_reference sets reference.object to &walk_state->local_variables[i] or &walk_state->arguments[i]. acpi_ds_terminate_control_method then acpi_ds_method_data_delete_all, acpi_ps_parse_aml still forwards return_desc, and acpi_ds_delete_walk_state frees the node. That sequence is deterministic with no race.\nPR:N - acpi_bus_init calls acpi_load_tables \u2192 acpi_tb_load_namespace \u2192 acpi_ns_load_table \u2192 acpi_ns_execute_table with no uid or capability check. Module-level AML that invokes a nested method returning RefOf(Local/Arg), with the caller Store/DerefOf using that value, hits acpi_ds_terminate_control_method at boot before any account exists.\nUI:N - acpi_ns_execute_table runs that nested Return(RefOf(Local/Arg)) automatically during acpi_load_tables in acpi_bus_init at power-on; the victim does not mount media, open a file, or otherwise interact.\nS:U - The dangling ACPI_REFCLASS_REFOF points at the embedded local_variables[]/arguments[] acpi_namespace_node inside the kmalloc'd acpi_walk_state freed by acpi_ds_delete_walk_state; that is host ACPICA heap corruption, not a KVM/Xen, IOMMU, or sandbox crossing.\nC:H - After acpi_ds_delete_walk_state, acpi_ns_resolve_references reads node->object from the freed local/arg pseudo-node, and a parent DerefOf uses operand[0]->reference.object the same way; that use-after-free of the walk_state slab is an arbitrary kernel-memory read, not a few-byte leak.\nI:H - A parent Store to the returned RefOf calls acpi_ex_store_object_to_node on the dangling node, and acpi_ns_resolve_references does acpi_ut_add_reference on node->object taken from freed walk_state memory; spraying that slab yields a write/refcount primitive and control-flow hijack.\nA:H - acpi_ds_delete_walk_state frees the walk_state while return_desc still aliases its local_variables[]/arguments[] nodes; later ns_resolve_references or DerefOf/Store through that pointer oopses or panics, and any use-after-free is Availability High."
    }
  }
}