CVE-2026-80593: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80593 Overview

CVE-2026-80593 is an out-of-bounds read vulnerability in the Linux kernel asus_atk0110 hardware monitoring (hwmon) driver. The flaw resides in the atk_ec_present() function, which iterates through the management group package returned by the GGRP ACPI method. The function reads the first element of each sub-package without verifying that the sub-package contains any elements. When firmware returns a sub-package with a zero package.count, the driver reads past the allocated element array.

Critical Impact
A malformed ACPI firmware package can trigger an out-of-bounds read in kernel memory, leading to potential information disclosure, kernel instability, or memory corruption on affected Linux systems using the ASUS ATK0110 hwmon driver.

Affected Products

Linux kernel versions containing the asus_atk0110 hwmon driver prior to the patched commits
Systems using the ASUS ATK0110 ACPI hardware monitoring interface
Distributions shipping the affected kernel with the hwmon subsystem enabled

Discovery Timeline

2026-08-28 - CVE-2026-80593 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80593

Vulnerability Analysis

The vulnerability exists in the atk_ec_present() function within the asus_atk0110 hwmon driver. The function processes the management group package returned by the ACPI GGRP method and accesses obj->package.elements[0] for each sub-package. It performs this access without first validating that the sub-package contains at least one element.

ACPICA allocates the element array with exactly package.count entries. When a sub-package reports a package.count of zero, the array has no allocated storage. The dereference of elements[0] then reads memory beyond the allocation boundary. The sibling function atk_debugfs_ggrp_open() already implements the required package.count check and skips empty packages correctly. The fix ports the same validation to atk_ec_present().

Root Cause

The root cause is missing input validation on ACPI-provided data structures. The driver trusts firmware-supplied package descriptors and dereferences their first element without a bounds check. This constitutes an out-of-bounds read primitive triggered through malicious or malformed firmware tables.

Attack Vector

Exploitation requires local access to a system running the vulnerable kernel with the asus_atk0110 driver loaded. The attack surface depends on the ability to influence ACPI firmware content or run on hardware with malformed ACPI tables. Successful triggering causes the kernel to read attacker-influenced memory locations, which can leak kernel state or destabilize the system. The vulnerability requires no user interaction and no prior authentication once local execution is achieved.

No public proof-of-concept exploit is available. Technical details are documented in the upstream kernel commits, including Kernel Git Commit 2a13712 and Kernel Git Commit 459b0a0.

Detection Methods for CVE-2026-80593

Indicators of Compromise

Unexpected kernel oops or panic messages referencing atk_ec_present or the asus_atk0110 module in dmesg or journalctl -k output
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads in the hwmon subsystem
Anomalous ACPI table modifications or unsigned firmware images on affected hosts

Detection Strategies

Inventory Linux systems running kernel versions predating the fix commits and verify whether the asus_atk0110 module is loaded using lsmod | grep asus_atk0110
Deploy kernel builds with KASAN enabled in test environments to surface out-of-bounds reads during ACPI initialization
Monitor kernel logs for driver initialization failures or warnings emitted by the hwmon subsystem during boot

Monitoring Recommendations

Forward kernel logs and audit events to a centralized log platform for correlation across the fleet
Track kernel package versions across endpoints and alert on hosts running unpatched builds
Include ACPI and hwmon driver telemetry in host baselining to detect deviations after firmware or BIOS updates

How to Mitigate CVE-2026-80593

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits as soon as vendor builds are available
Update distribution kernels to the latest stable release incorporating the fix
Restrict local access on affected systems and enforce least-privilege policies until patching is complete

Patch Information

The fix adds a package.count check to atk_ec_present() mirroring the existing validation in atk_debugfs_ggrp_open(). Patched commits are available in the stable kernel tree, including Kernel Git Commit 76392d3, Kernel Git Commit 768f20e, Kernel Git Commit 981a8a2, Kernel Git Commit b770fcf, Kernel Git Commit d8d4fa0, and Kernel Git Commit e2735b39. Consult your distribution's security advisories for backported package versions.

Workarounds

Blacklist the asus_atk0110 module on systems that do not require ASUS hardware monitoring functionality
Prevent module auto-loading by adding install asus_atk0110 /bin/true to a modprobe configuration file
Verify BIOS and firmware integrity and apply vendor firmware updates that may correct malformed ACPI package descriptors

bash

# Blacklist the vulnerable module until patched kernel is deployed
echo "blacklist asus_atk0110" | sudo tee /etc/modprobe.d/blacklist-asus_atk0110.conf
sudo rmmod asus_atk0110 2>/dev/null || true
sudo update-initramfs -u