CVE-2026-89587: Linux Kernel ACPI Buffer Overflow Vulnerability

CVE-2026-89587 Overview

CVE-2026-89587 is a stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime (PFR) update subsystem. The flaw resides in query_capability() within the pfr_update driver. The function copies four ACPI buffer objects returned by the firmware _DSM method into fixed-size u8[16] fields inside struct pfru_update_cap_info using memcpy with the firmware-supplied length. When the firmware returns a buffer larger than 16 bytes for code_type, drv_type, platform_id, or oem_id, memcpy writes past the destination array. The affected struct pfru_update_cap_info is stack-allocated inside pfru_ioctl(), making the overflow a stack corruption issue.

Critical Impact
A local attacker with access to the PFR update ioctl interface can trigger stack corruption in the kernel, potentially leading to privilege escalation or denial of service.

Affected Products

Linux kernel builds that include the drivers/acpi/pfr_update.c ACPI Platform Firmware Runtime update driver
Systems exposing the PFR update ioctl interface to user space
Distribution kernels prior to the fixes referenced in commits 15d2b7f, 6d4ed2f, a2151624, c5a31b4, ced45be, and d3af83e

Discovery Timeline

2026-09-11 - CVE-2026-89587 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89587

Vulnerability Analysis

The query_capability() function in drivers/acpi/pfr_update.c invokes the ACPI _DSM method to retrieve platform firmware update capability metadata. The returned ACPI object is a package of four buffer elements: CAP_CODE_TYPE_IDX, CAP_DRV_TYPE_IDX, CAP_PLATFORM_ID_IDX, and CAP_OEM_ID_IDX. The driver copies each buffer into a corresponding 16-byte field of struct pfru_update_cap_info using the firmware-supplied buffer.length as the memcpy size argument. No bounds check confirms that buffer.length is less than or equal to 16.

KASAN validation on kernel 7.2-rc6 produced three stack-out-of-bounds reports when a crafted _DSM implementation returned 64-byte buffers. Writes reached up to 44 bytes beyond the end of cap_hdr's stack frame window, corrupting adjacent stack redzones. Because struct pfru_update_cap_info is allocated on the stack inside pfru_ioctl(), the overflow directly overwrites saved registers, return addresses, or other stack-resident state.

Root Cause

The root cause is missing input validation on data supplied by platform firmware. The driver trusts the length field embedded in the ACPI buffer descriptor and passes it unchecked to memcpy. This is a classic stack buffer overflow pattern where an attacker-influenceable length drives a fixed-size copy destination.

Attack Vector

Exploitation requires local access with permissions to invoke the PFR update ioctl and control over the values returned by the firmware _DSM method. On systems where firmware can be influenced by an attacker, or on virtualized and test platforms where the ACPI tables and DSM behavior are controllable, a low-privileged local process can trigger the overflow. The upstream fix introduces a helper pointer to out_obj->package.elements and validates each buffer length against its destination field size before copying, returning -EINVAL if the firmware supplies an oversized buffer. See the kernel patch commit 15d2b7f for the reference implementation.

Detection Methods for CVE-2026-89587

Indicators of Compromise

KASAN stack-out-of-bounds reports referencing query_capability or pfru_ioctl in kernel logs
Unexpected kernel oops or stack canary violations originating in drivers/acpi/pfr_update.c
Process invocations of ioctls against /dev/acpi_pfr_update* character devices by unprivileged or unexpected users

Detection Strategies

Enable KASAN in test kernels to surface stack-out-of-bounds writes during PFR update operations
Audit kernel version and confirm whether the six upstream patch commits are backported to production builds
Monitor kernel ring buffer and syslog for panic messages referencing pfru_update_cap_info or ACPI _DSM handlers

Monitoring Recommendations

Track ioctl activity against PFR update device nodes and correlate with process identity
Alert on kernel crashes or reboots that follow firmware update capability queries
Inventory hosts that expose the PFR update interface and prioritize them for patching

How to Mitigate CVE-2026-89587

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits 15d2b7f, 6d4ed2f, a2151624, c5a31b4, ced45be, and d3af83e
Restrict access to the PFR update character device to root or a dedicated firmware-management group
Disable the pfr_update kernel module on systems that do not require ACPI platform firmware runtime updates

Patch Information

The fix adds explicit length validation before each memcpy call in query_capability(). If any of the four ACPI buffers exceeds its 16-byte destination field, the function returns -EINVAL and aborts the copy. Patch sources include the kernel stable commit 6d4ed2f, the kernel stable commit a2151624, the kernel stable commit c5a31b4, the kernel stable commit ced45be, and the kernel stable commit d3af83e.

Workarounds

Unload the pfr_update module with modprobe -r pfr_update where firmware updates are managed out-of-band
Blacklist the module in /etc/modprobe.d/ on hosts that do not require runtime firmware updates
Tighten permissions on /dev/acpi_pfr_update* to prevent unprivileged access

bash

# Configuration example
echo 'blacklist pfr_update' | sudo tee /etc/modprobe.d/disable-pfr-update.conf
sudo modprobe -r pfr_update
sudo chmod 600 /dev/acpi_pfr_update* 2>/dev/null || true