CVE-2026-89436: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89436 Overview

CVE-2026-89436 is a heap out-of-bounds write in the Linux kernel panasonic-laptop platform driver. The flaw resides in acpi_pcc_retrieve_biosdata(), which unconditionally writes a trailing sentinel value at pcc->sinf[hkey->package.count]. When a DSDT's SINF package count equals SQTY+1, the existing off-by-one workaround makes num_sifr equal to package.count, causing the sentinel write to overflow the pcc->sinf[] allocation by one element. The condition was discovered via UBSan on hardware where HKEY.SQTY returns 37 and HKEY.SINF() returns a 38-element package, producing a silent 4-byte heap overflow on kernels built without CONFIG_UBSAN.

Critical Impact
A local, low-privileged user on affected Panasonic laptop hardware can trigger a 4-byte heap out-of-bounds write, enabling potential memory corruption and local privilege escalation.

Affected Products

Linux kernel builds including the platform/x86: panasonic-laptop driver
Panasonic laptops whose ACPI DSDT exhibits the SINF/SQTY off-by-one where package.count == num_sifr
Distributions shipping vulnerable stable kernels prior to commits 329f10d8be19 and a93df956ee4d

Discovery Timeline

2026-09-11 - CVE-2026-89436 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89436

Vulnerability Analysis

The vulnerability is a heap-based out-of-bounds write [CWE-787] in the Panasonic laptop ACPI driver. The function acpi_pcc_retrieve_biosdata() validates the SINF package by rejecting it only when pcc->num_sifr is strictly less than hkey->package.count. After the loop populates entries, the driver writes a trailing sentinel value at index hkey->package.count without verifying that the index is within the allocated buffer.

The pcc->sinf[] array is allocated with exactly pcc->num_sifr elements, so valid indices are 0..num_sifr-1. Safe sentinel placement therefore requires num_sifr > package.count. The equality case num_sifr == package.count bypasses the existing check and writes one element past the end of the heap allocation.

An attacker with local access to a vulnerable Panasonic device can trigger driver initialization paths that exercise this code, corrupting adjacent heap metadata or object fields. Depending on the neighboring allocation, the 4-byte overwrite can be leveraged for privilege escalation or denial of service.

Root Cause

The root cause is an off-by-one boundary check interacting with a compensating workaround. The probe() function increments num_sifr by one to accommodate DSDTs where the SINF package count exceeds SQTY by one. That workaround produces the exact num_sifr == package.count state that the sentinel write cannot safely handle, because the rejection condition uses strict less-than rather than less-than-or-equal.

Attack Vector

Exploitation requires local access with low privileges on hardware whose ACPI firmware exhibits the SINF/SQTY off-by-one. The vulnerable path executes during driver probe and BIOS data retrieval, so triggering repeated invocations depends on module reload or driver-initiated queries. The write value is a fixed sentinel, so exploitation relies on heap grooming to place a security-relevant object adjacent to pcc->sinf[]. See the kernel commits referenced below for the full source-level diff:

Detection Methods for CVE-2026-89436

Indicators of Compromise

UBSan reports in kernel logs referencing array-index-out-of-bounds in drivers/platform/x86/panasonic-laptop.c or acpi_pcc_retrieve_biosdata.
KASAN slab-out-of-bounds write reports naming the pcc->sinf allocation during panasonic_laptop module load.
Unexpected kernel oops or slab corruption warnings shortly after loading the panasonic-laptop module on affected hardware.

Detection Strategies

Enable CONFIG_UBSAN and CONFIG_KASAN in test kernels to surface the out-of-bounds sentinel write deterministically.
Inventory Panasonic endpoints and compare running kernel versions against the fixed commits 329f10d8be19 and a93df956ee4d.
Audit ACPI DSDT contents on suspect hardware to identify systems where HKEY.SINF() returns a package with count == SQTY + 1.

Monitoring Recommendations

Forward kernel ring buffer and journald logs to a centralized analytics platform and alert on UBSan or KASAN signatures involving panasonic-laptop.
Monitor for unexplained kernel crashes on Panasonic hardware fleets and correlate with panasonic_laptop module load events.
Track kernel package versions across Linux endpoints to confirm patch adoption over time.

How to Mitigate CVE-2026-89436

Immediate Actions Required

Update affected Linux systems to a stable kernel release containing commits 329f10d8be193bf36af124e00b9dd6644cd71724 and a93df956ee4d903735b6d395362c839cb1dc07e3.
On unpatched hosts, blacklist the panasonic_laptop kernel module until the fix is deployed.
Restrict local access to affected Panasonic hardware, since exploitation requires a local low-privileged account.

Patch Information

The fix modifies acpi_pcc_retrieve_biosdata() to skip the trailing sentinel write when there is no room in pcc->sinf[]. The driver no longer writes past the allocated buffer when num_sifr == package.count, and no other code path reads that sentinel value. Apply the upstream patches referenced in the Kernel Git Commit 329f10d and Kernel Git Commit a93df95 advisories, or install the distribution kernel update that backports them.

Workarounds

Prevent driver load by blacklisting the module in /etc/modprobe.d/.
Build kernels with CONFIG_UBSAN=y so the out-of-bounds write is trapped rather than silently corrupting the heap.
Limit physical and interactive access to affected Panasonic laptops until patched kernels are deployed.

bash

# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist panasonic_laptop" | sudo tee /etc/modprobe.d/blacklist-panasonic-laptop.conf
sudo rmmod panasonic_laptop 2>/dev/null || true
sudo update-initramfs -u