CVE-2026-31426: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31426 Overview

A use-after-free vulnerability has been identified in the Linux kernel's ACPI Embedded Controller (EC) subsystem. The flaw occurs in the acpi_ec_setup() function when ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware platforms. In this scenario, the EC has already been started and the address space handler installed with a struct acpi_ec pointer as the handler context. However, acpi_ec_setup() propagates the error without performing any cleanup operations.

The calling function acpi_ec_add() subsequently frees the struct acpi_ec for non-boot instances, leaving a dangling handler context in ACPICA. Any subsequent AML (ACPI Machine Language) evaluation that accesses an EC OpRegion field dispatches into acpi_ec_space_handler() with the freed pointer, triggering a use-after-free condition.

Critical Impact
This vulnerability allows unprivileged users to potentially trigger memory corruption through sysfs reads that cause AML to access EC OpRegion fields (battery, thermal, backlight subsystems), leading to system instability or potential privilege escalation.

Affected Products

Linux kernel versions with ACPI EC support on reduced-hardware platforms
Systems where GPIO IRQ provider defers probing (ec->gpe < 0)
Linux kernel builds with KASAN enabled may detect this as slab-use-after-free

Discovery Timeline

April 13, 2026 - CVE-2026-31426 published to NVD
April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31426

Vulnerability Analysis

This use-after-free vulnerability is triggered through a specific error handling path in the Linux kernel's ACPI EC driver. The bug occurs on reduced-hardware EC platforms where ec->gpe < 0 and the GPIO IRQ provider defers probing. When the probe deferral occurs, the kernel fails to properly clean up the already-installed handler context before freeing the associated memory structure.

The vulnerability manifests in the mutex_lock call within acpi_ec_space_handler() at drivers/acpi/ec.c:1362. The call trace demonstrates how AML evaluation triggers the dangling pointer access through the ACPICA subsystem's address space dispatch mechanism.

Root Cause

The root cause lies in the incomplete error handling within acpi_ec_setup(). When ec_install_handlers() returns -EPROBE_DEFER, it has already:

Started the EC subsystem
Installed the address space handler with a struct acpi_ec pointer as context

However, acpi_ec_setup() propagates this error without calling the corresponding cleanup routine. The subsequent kfree() call in acpi_ec_add() at line 1751 releases the struct acpi_ec memory that was allocated at line 1424, but the handler remains registered in ACPICA with a now-invalid pointer.

Attack Vector

The exploitation path requires the following conditions:

A reduced-hardware EC platform with ec->gpe < 0
GPIO IRQ provider that defers probing
AML code that accesses EC OpRegion fields

Once the stale handler exists in the system, any unprivileged sysfs read operation that triggers AML evaluation touching an EC OpRegion (commonly battery status, thermal sensors, or backlight controls) will exercise the dangling pointer. This can be triggered through standard system monitoring utilities or direct sysfs access without requiring elevated privileges.

The KASAN output demonstrates the memory corruption:

BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289)
Write of size 8 at addr ffff88800721de38 by task init/1

Detection Methods for CVE-2026-31426

Indicators of Compromise

KASAN (Kernel Address Sanitizer) reports indicating slab-use-after-free in mutex_lock within acpi_ec_space_handler
Kernel oops or panics with call traces involving acpi_ev_address_space_dispatch and acpi_ec_space_handler
System instability when accessing battery, thermal, or backlight information via sysfs on reduced-hardware platforms
Unexpected system crashes during GPIO IRQ provider probe deferrals on ACPI-enabled systems

Detection Strategies

Enable KASAN in kernel builds to detect use-after-free conditions during testing and development
Monitor kernel logs for ACPI EC-related errors, particularly -EPROBE_DEFER return codes during boot
Implement runtime memory debugging tools to detect dangling pointer access in ACPICA subsystem
Audit systems with reduced-hardware EC configurations for unexplained crashes during AML evaluation

Monitoring Recommendations

Configure kernel logging to capture ACPI EC subsystem debug messages at boot time
Deploy endpoint detection solutions capable of monitoring kernel memory corruption events
Establish baseline behavior for ACPI EC initialization on affected platforms to detect anomalies
Monitor sysfs access patterns to EC-related paths (battery, thermal, backlight) for unusual activity

How to Mitigate CVE-2026-31426

Immediate Actions Required

Apply the Linux kernel patches from the stable kernel tree immediately on affected systems
Prioritize patching on systems with reduced-hardware EC platforms or GPIO IRQ defer scenarios
Enable KASAN during testing to verify the vulnerability has been addressed
Review system logs for evidence of prior exploitation attempts before patching

Patch Information

The fix has been committed to multiple Linux kernel stable branches. The patch adds a call to ec_remove_handlers() in the error path of acpi_ec_setup() before clearing first_ec. The ec_remove_handlers() function checks each EC_FLAGS_* bit before acting, making it safe to call regardless of how far ec_install_handlers() progressed:

-ENODEV (handler not installed): only calls acpi_ec_stop()
-EPROBE_DEFER (handler installed): removes handler and stops EC

Available patches:

Workarounds

If immediate patching is not possible, restrict access to sysfs paths related to battery, thermal, and backlight subsystems
Consider disabling or limiting access to ACPI EC functionality on affected reduced-hardware platforms until patches are applied
Implement access controls to prevent unprivileged users from triggering AML evaluation on vulnerable systems

bash

# Configuration example
# Restrict sysfs access to EC-related paths temporarily
# Note: This may impact system functionality
chmod 600 /sys/class/power_supply/*/uevent
chmod 600 /sys/class/thermal/*/temp
chmod 600 /sys/class/backlight/*/brightness