CVE-2026-31426 (GCVE-0-2026-31426)

Vulnerability from cvelistv5 – Published: 2026-04-13 13:40 – Updated: 2026-04-13 13:40
VLAI?
Title
ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
Summary
In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware platforms, it has already started the EC and installed the address space handler with the struct acpi_ec pointer as handler context. However, acpi_ec_setup() propagates the error without any cleanup. The caller acpi_ec_add() then frees the struct acpi_ec for non-boot instances, leaving a dangling handler context in ACPICA. Any subsequent AML evaluation that accesses an EC OpRegion field dispatches into acpi_ec_space_handler() with the freed pointer, causing a use-after-free: BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289) Write of size 8 at addr ffff88800721de38 by task init/1 Call Trace: <TASK> mutex_lock (kernel/locking/mutex.c:289) acpi_ec_space_handler (drivers/acpi/ec.c:1362) acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293) acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246) acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509) acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700) acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327) acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392) </TASK> Allocated by task 1: acpi_ec_alloc (drivers/acpi/ec.c:1424) acpi_ec_add (drivers/acpi/ec.c:1692) Freed by task 1: kfree (mm/slub.c:6876) acpi_ec_add (drivers/acpi/ec.c:1751) The bug triggers on reduced-hardware EC platforms (ec->gpe < 0) when the GPIO IRQ provider defers probing. Once the stale handler exists, any unprivileged sysfs read that causes AML to touch an EC OpRegion (battery, thermal, backlight) exercises the dangling pointer. Fix this by calling ec_remove_handlers() in the error path of acpi_ec_setup() before clearing first_ec. ec_remove_handlers() checks each EC_FLAGS_* bit before acting, so it is safe to call regardless of how far ec_install_handlers() progressed: -ENODEV (handler not installed): only calls acpi_ec_stop() -EPROBE_DEFER (handler installed): removes handler, stops EC
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 03e9a0e05739cf872fee494b06c75c0469704a21 , < 022d1727f33ff90b3e1775125264e3023901952e (git)
Affected: 03e9a0e05739cf872fee494b06c75c0469704a21 , < 9c886e63b69658959633937e3acb7ca8addf7499 (git)
Affected: 03e9a0e05739cf872fee494b06c75c0469704a21 , < 808c0f156f48d5b8ca34088cbbfba8444e606cbc (git)
Affected: 03e9a0e05739cf872fee494b06c75c0469704a21 , < d04c007047c88158141d9bd5eac761cdadd3782c (git)
Affected: 03e9a0e05739cf872fee494b06c75c0469704a21 , < be1a827e15991e874e0d5222d0ea5fdad01960fe (git)
Affected: 03e9a0e05739cf872fee494b06c75c0469704a21 , < f6484cadbcaf26b5844b51bd7307a663dda48ef6 (git)
Create a notification for this product.
    Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 6.1.168 , ≤ 6.1.* (semver)
Unaffected: 6.6.131 , ≤ 6.6.* (semver)
Unaffected: 6.12.80 , ≤ 6.12.* (semver)
Unaffected: 6.18.21 , ≤ 6.18.* (semver)
Unaffected: 6.19.11 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/ec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "022d1727f33ff90b3e1775125264e3023901952e",
              "status": "affected",
              "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
              "versionType": "git"
            },
            {
              "lessThan": "9c886e63b69658959633937e3acb7ca8addf7499",
              "status": "affected",
              "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
              "versionType": "git"
            },
            {
              "lessThan": "808c0f156f48d5b8ca34088cbbfba8444e606cbc",
              "status": "affected",
              "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
              "versionType": "git"
            },
            {
              "lessThan": "d04c007047c88158141d9bd5eac761cdadd3782c",
              "status": "affected",
              "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
              "versionType": "git"
            },
            {
              "lessThan": "be1a827e15991e874e0d5222d0ea5fdad01960fe",
              "status": "affected",
              "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
              "versionType": "git"
            },
            {
              "lessThan": "f6484cadbcaf26b5844b51bd7307a663dda48ef6",
              "status": "affected",
              "version": "03e9a0e05739cf872fee494b06c75c0469704a21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/ec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: EC: clean up handlers on probe failure in acpi_ec_setup()\n\nWhen ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware\nplatforms, it has already started the EC and installed the address\nspace handler with the struct acpi_ec pointer as handler context.\nHowever, acpi_ec_setup() propagates the error without any cleanup.\n\nThe caller acpi_ec_add() then frees the struct acpi_ec for non-boot\ninstances, leaving a dangling handler context in ACPICA.\n\nAny subsequent AML evaluation that accesses an EC OpRegion field\ndispatches into acpi_ec_space_handler() with the freed pointer,\ncausing a use-after-free:\n\n BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289)\n Write of size 8 at addr ffff88800721de38 by task init/1\n Call Trace:\n  \u003cTASK\u003e\n  mutex_lock (kernel/locking/mutex.c:289)\n  acpi_ec_space_handler (drivers/acpi/ec.c:1362)\n  acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293)\n  acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246)\n  acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509)\n  acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700)\n  acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327)\n  acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392)\n  \u003c/TASK\u003e\n\n Allocated by task 1:\n  acpi_ec_alloc (drivers/acpi/ec.c:1424)\n  acpi_ec_add (drivers/acpi/ec.c:1692)\n\n Freed by task 1:\n  kfree (mm/slub.c:6876)\n  acpi_ec_add (drivers/acpi/ec.c:1751)\n\nThe bug triggers on reduced-hardware EC platforms (ec-\u003egpe \u003c 0)\nwhen the GPIO IRQ provider defers probing. Once the stale handler\nexists, any unprivileged sysfs read that causes AML to touch an\nEC OpRegion (battery, thermal, backlight) exercises the dangling\npointer.\n\nFix this by calling ec_remove_handlers() in the error path of\nacpi_ec_setup() before clearing first_ec. ec_remove_handlers()\nchecks each EC_FLAGS_* bit before acting, so it is safe to call\nregardless of how far ec_install_handlers() progressed:\n\n  -ENODEV  (handler not installed): only calls acpi_ec_stop()\n  -EPROBE_DEFER (handler installed): removes handler, stops EC"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:40:29.635Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/022d1727f33ff90b3e1775125264e3023901952e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c886e63b69658959633937e3acb7ca8addf7499"
        },
        {
          "url": "https://git.kernel.org/stable/c/808c0f156f48d5b8ca34088cbbfba8444e606cbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d04c007047c88158141d9bd5eac761cdadd3782c"
        },
        {
          "url": "https://git.kernel.org/stable/c/be1a827e15991e874e0d5222d0ea5fdad01960fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6484cadbcaf26b5844b51bd7307a663dda48ef6"
        }
      ],
      "title": "ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31426",
    "datePublished": "2026-04-13T13:40:29.635Z",
    "dateReserved": "2026-03-09T15:48:24.088Z",
    "dateUpdated": "2026-04-13T13:40:29.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31426",
      "date": "2026-04-18",
      "epss": "0.00024",
      "percentile": "0.0661"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31426\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-13T14:16:12.600\",\"lastModified\":\"2026-04-13T15:01:43.663\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nACPI: EC: clean up handlers on probe failure in acpi_ec_setup()\\n\\nWhen ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware\\nplatforms, it has already started the EC and installed the address\\nspace handler with the struct acpi_ec pointer as handler context.\\nHowever, acpi_ec_setup() propagates the error without any cleanup.\\n\\nThe caller acpi_ec_add() then frees the struct acpi_ec for non-boot\\ninstances, leaving a dangling handler context in ACPICA.\\n\\nAny subsequent AML evaluation that accesses an EC OpRegion field\\ndispatches into acpi_ec_space_handler() with the freed pointer,\\ncausing a use-after-free:\\n\\n BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289)\\n Write of size 8 at addr ffff88800721de38 by task init/1\\n Call Trace:\\n  \u003cTASK\u003e\\n  mutex_lock (kernel/locking/mutex.c:289)\\n  acpi_ec_space_handler (drivers/acpi/ec.c:1362)\\n  acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293)\\n  acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246)\\n  acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509)\\n  acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700)\\n  acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327)\\n  acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392)\\n  \u003c/TASK\u003e\\n\\n Allocated by task 1:\\n  acpi_ec_alloc (drivers/acpi/ec.c:1424)\\n  acpi_ec_add (drivers/acpi/ec.c:1692)\\n\\n Freed by task 1:\\n  kfree (mm/slub.c:6876)\\n  acpi_ec_add (drivers/acpi/ec.c:1751)\\n\\nThe bug triggers on reduced-hardware EC platforms (ec-\u003egpe \u003c 0)\\nwhen the GPIO IRQ provider defers probing. Once the stale handler\\nexists, any unprivileged sysfs read that causes AML to touch an\\nEC OpRegion (battery, thermal, backlight) exercises the dangling\\npointer.\\n\\nFix this by calling ec_remove_handlers() in the error path of\\nacpi_ec_setup() before clearing first_ec. ec_remove_handlers()\\nchecks each EC_FLAGS_* bit before acting, so it is safe to call\\nregardless of how far ec_install_handlers() progressed:\\n\\n  -ENODEV  (handler not installed): only calls acpi_ec_stop()\\n  -EPROBE_DEFER (handler installed): removes handler, stops EC\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/022d1727f33ff90b3e1775125264e3023901952e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/808c0f156f48d5b8ca34088cbbfba8444e606cbc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9c886e63b69658959633937e3acb7ca8addf7499\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/be1a827e15991e874e0d5222d0ea5fdad01960fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d04c007047c88158141d9bd5eac761cdadd3782c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f6484cadbcaf26b5844b51bd7307a663dda48ef6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.