CVE-2026-64512 Overview
CVE-2026-64512 is a Linux kernel vulnerability in the Advanced Configuration and Power Interface (ACPI) Collaborative Processor Performance Control (CPPC) subsystem. The flaw resides in drivers/acpi/cppc_acpi.c and triggers an Undefined Behavior Sanitizer (UBSAN) warning due to a shift-out-of-bounds condition. The issue occurs because the reg->access_width field has different meanings depending on the reg->space_id type. When the space type is ACPI_ADR_SPACE_PLATFORM_COMM, the field indicates the Platform Communication Channel (PCC) region rather than an access width, and values greater than 4 cause an invalid bit shift on a 32-bit integer.
Critical Impact
The vulnerability produces UBSAN warnings during CPU frequency initialization on affected ARM64 and other platforms using CPPC, potentially indicating undefined behavior in kernel execution paths.
Affected Products
- Linux kernel versions containing the affected cppc_acpi.c implementation prior to the fix
- Systems using ACPI CPPC with ACPI_ADR_SPACE_PLATFORM_COMM register space
- ARM64 platforms leveraging the cppc_cpufreq driver
Discovery Timeline
- 2026-07-25 - CVE-2026-64512 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64512
Vulnerability Analysis
The vulnerability originates in the cpc_write function within drivers/acpi/cppc_acpi.c at line 1090. The ACPI CPPC subsystem uses a generic register descriptor structure where access_width is interpreted differently based on space_id. For memory-mapped I/O and system I/O regions, access_width encodes the register access size. For ACPI_ADR_SPACE_PLATFORM_COMM regions, however, it encodes the PCC subspace identifier.
When kernel code performs a bit shift operation using this field without validating the region type, values greater than 4 produce a shift exponent of 32 or larger applied to a 32-bit integer. This is undefined behavior in C and is detected by UBSAN at runtime. The kernel call trace shows the issue surfacing through cppc_cpufreq_cpu_init and cppc_set_perf during CPU frequency driver initialization.
Root Cause
The root cause is field misuse combined with missing input validation. The access_width field is polymorphic across space_id types, but the shift computation treated it uniformly. The fix validates the region type and confirms access_width holds a valid value before performing the shift, and returns bit_width directly for ACPI_ADR_SPACE_PLATFORM_COMM regions rather than applying size correction logic.
Attack Vector
This is a local, kernel-side condition triggered during hardware initialization on systems whose firmware exposes CPPC registers using the PCC address space. Exploitation requires the affected firmware configuration to be present and the CPPC cpufreq driver to load. See the Linux kernel commit fix for technical details of the corrected shift logic.
Detection Methods for CVE-2026-64512
Indicators of Compromise
- Kernel log entries containing UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090
- Messages reporting shift exponent 32 is too large for 32-bit type 'int'
- Call traces including __ubsan_handle_shift_out_of_bounds, cpc_write, and cppc_set_perf
Detection Strategies
- Monitor dmesg and /var/log/kern.log for UBSAN warnings referencing cppc_acpi.c
- Query kernel version and ACPI CPPC configuration across the fleet to identify hosts running unpatched builds
- Correlate UBSAN traces with cppc_cpufreq module loads to confirm the specific code path
Monitoring Recommendations
- Forward kernel logs from Linux hosts to a centralized log platform for pattern matching on UBSAN signatures
- Establish alerting on repeated shift-out-of-bounds warnings from ACPI subsystem drivers
- Track kernel package versions and CPPC-enabled hardware inventory to prioritize patch deployment
How to Mitigate CVE-2026-64512
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable kernel commits
- Update to a kernel release that incorporates the ACPI CPPC field validation fix
- Verify vendor kernel builds from your Linux distribution include the backported fix
Patch Information
The fix is available through multiple stable kernel commits, including commit b54c4632, commit e904596b, commit 37f28bf8, commit 2fb80e96, commit dc066bd1, commit 1b1acf2d, and commit f29dc613. The patch validates the register region type and ensures access_width holds a valid value before the shift operation.
Workarounds
- Where feasible, unload the cppc_cpufreq module on affected systems until a patched kernel is deployed
- Consider selecting an alternative cpufreq governor that does not rely on CPPC on affected hardware
- Coordinate with hardware vendors to confirm firmware ACPI table conformance for CPPC register descriptions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
