Out-of-bounds read in Linux kernel - CVE-2026-97453
Published: September 24, 2026
Vulnerability identifier: #VU152020
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-97453
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to read beyond the bounds of an ACPI package buffer.
The vulnerability exists due to improper validation of an encoded package length byte count in acpi_ps_get_next_package_length() when parsing ACPI package lengths. A local user can cause the function to process an encoded byte count exceeding the remaining available bytes to read beyond the bounds of an ACPI package buffer.
Affected software
Linux kernel
How to mitigate CVE-2026-97453
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3