From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-97455][MODERATE REGULAR] ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() [ Upstream Date: Thu, 24 Sep 2026 20:48:01 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-97455 X-AL-KERNEL-Priority: MODERATE REGULAR X-AL-KERNEL-Severity: MODERATE REGULAR X-AL-KERNEL-Base-Severity: MODERATE X-AL-KERNEL-KPANIC: NO X-AL-KERNEL-ActionableScore: 4 X-AL-KERNEL-ActionableScore-Lower: unknown X-AL-KERNEL-Commit: fe7b3d3b7490c2c0119f2d84fa33996dcbc71042 List-Id: CVE: CVE-2026-97455 Priority: MODERATE REGULAR AL-KERNEL base severity: MODERATE KPANIC flag: NO Patch: ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() [ Upstream Commit: fe7b3d3b7490c2c0119f2d84fa33996dcbc71042 Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fe7b3d3b7490c2c0119f2d84fa33996dcbc71042 Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97455 Analysis date: Thu, 24 Sep 2026 20:48:01 -0400 ActionableScore: 4 ActionableScore lower bound: unknown Actionable bucket: Borderline / manual review recommended Manual review required: YES Summary: A returned ACPICA RefOf object can retain a reference to method-local or argument storage after the control-method walk state is destroyed, creating a kernel use-after-free condition whose practical reachability and post-free use require further review. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-97455 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97455 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: MODERATE REGULAR Manual review required: YES A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-97455 MODERATE https://www.kernelcve.org/list/?q=CVE-2026-97455 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H';*CWE-416;*CWE-664;*CWE-672;Other CVSS 'AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '6.4';DESCR 'A use after free can occur in the ACPICA control method termination path when a returned RefOf object references a method local or argument that is destroyed together with the walk state. A later use of the returned dangling reference may access freed kernel memory and can at least cause a kernel crash. For the CVSS the PR:H is used because reliable triggering normally requires control over AML supplied by ACPI firmware or the ability to install or override ACPI tables, which is generally administrative. The issue is not directly network reachable. The base impact is local denial of service. The paranoid assessment allows confidentiality and integrity impact because the flaw is a kernel use after free, but exploitation beyond denial of service is not demonstrated by the patch and requires manual review.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Borderline / manual review recommended (with actual score 4) YES DANGER UAF DECREASED_TO_MODERATEREG_BASED_ON_FALSEPOSCHECKOFKP NO NO checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=4 PrimitiveClass=CLASS_B RealUAF=YES HostAdminRequired=UNKNOWN NamespaceScopedPrivilege=UNKNOWN ImportantCandidate=NO ManualReview=RECOMMENDED AutoDowngradeAllowed=YES ## 1. ActionableScore * Raw conservative score: 2 * Conservative score: 4 * Raw paranoid score: 2 * Paranoid score: 4 * Final recommended bucket: **Borderline / manual review recommended**:: The raw score contains the directly established lifetime primitive only. The Real UAF FLOOR 4 is applied because a returned ACPI reference can outlive destruction of the associated `walk_state`, and host-admin-equivalent privilege is not positively established by the supplied patch. No paranoid uplift is justified because controlled reclaim, a second lifetime mutation, attacker-controlled replacement, disclosure, arbitrary write, or privilege escalation are not established. ## 2. Signal breakdown Positive signals: * +2 Real UAF or active lifetime violation. The patch explicitly identifies that `walk_state->return_desc` may contain an `ACPI_REFCLASS_REFOF` reference to a method local or argument. These local and argument slots are deleted when the `walk_state` is destroyed, while the returned reference can otherwise survive and become dangling. Floor application: * Real UAF FLOOR 4 applied. Raw score 2 is raised to 4 because the patch directly prevents a post-lifetime reference from surviving method teardown. This is not clearly a fixed async DMA buffer or a guaranteed immediate poison-pointer fault. Non-awarded or withheld signals: * +0 Reliable kernel crash or strong DoS. A stale reference can plausibly cause a kernel fault, but the supplied patch and context do not demonstrate an observed panic, reliable crash, or a specific later dereference site. * +0 Controlled reclaim or controlled object replacement. No evidence shows that an attacker can reclaim the former `walk_state` storage with attacker-shaped contents. * +0 Strong exploitation leverage. No attacker-controlled callback, function pointer, offset, length, refcount takeover, directed write, or active structured-object reuse is established. * +0 Structured stale-object exploitation leverage. The stale reference targets method-local or argument storage during ACPICA control-method termination. The visible patch does not show a meaningful later consumption of attacker-controlled fields after reuse. * +0 Concrete repeated release or refcount mutation. The patch removes one returned reference before locals and arguments are deleted. It does not establish a first release followed by a second `put`, `free`, or refcount mutation through the exact same dangling reference. * +0 Confidentiality impact. No read-back or disclosure path is shown. * +0 Integrity impact. No unauthorized modification or write primitive is shown. * +0 Local unprivileged trigger. The supplied material does not establish that an ordinary local user can provide or invoke attacker-controlled AML that reaches this condition. * +0 Remote reachability. ACPI AML is firmware-mediated input. The patch provides no direct network path. * No privilege penalty applied. The prior PR:H interpretation is plausible for custom ACPI-table installation or firmware override, but it is not positively established as a complete prerequisite by the supplied call path. Under the stated rules, this remains unknown rather than receiving a host-admin penalty. * No hard-race penalty applied. This is an ordered lifetime problem during control-method teardown, not a demonstrated timing race. * No niche-subsystem penalty applied. ACPICA is broadly present on ACPI-capable systems, and subsystem reputation alone is not a valid negative signal. ## 3. Reachability analysis The vulnerable condition requires an ACPI control method to return a `RefOf` reference that points to one of its own method-local or argument slots. The method then terminates and destroys the `walk_state`, leaving the returned object with a reference to storage whose lifetime has ended. The relevant attacker model is unresolved. Supplying malicious AML normally implies control of firmware-provided ACPI tables, a table override mechanism, or another platform-specific ACPI-table loading path. Such operations often require firmware compromise or administrative control, but the supplied patch does not show the complete table-loading path, any relevant capability checks, or whether a pre-existing firmware method can be invoked through an interface reachable by a less-privileged local user. Therefore: * Host-admin-equivalent privilege is not positively established. `HostAdminRequired=UNKNOWN`. * Below-host-admin reachability is also not positively established. This prevents assigning `HostAdminRequired=NO`. * No namespace-based trigger is described. `NamespaceScopedPrivilege=UNKNOWN`. * No network trigger is established. Firmware-mediated AML input is not direct remote reachability. * No special hardware requirement beyond a system using ACPICA/ACPI is proven. However, practical exploitation may depend on platform firmware behavior and AML method reachability. * No race or repeatable attacker-controlled free/reuse sequence is visible in the supplied patch. ## 4. Primitive and severity interpretation The exact primitive is a real lifetime violation: a returned `ACPI_TYPE_LOCAL_REFERENCE` with `ACPI_REFCLASS_REFOF` can reference a method-local or method-argument slot stored in `struct acpi_walk_state`. When `acpi_ds_terminate_control_method()` deletes that walk state, the referenced storage loses its valid lifetime. The returned reference can therefore become stale and may later be used. This is an active structured lifetime issue rather than fixed stale DMA or device storage. However, the visible fix is in a control-method teardown path, and the supplied context does not show the later stale-use operation, attacker-controlled replacement contents, callback dispatch, pointer traversal through reclaimed data, repeated refcount mutation, or an arbitrary read/write primitive. This is therefore `CLASS_B`, not `CLASS_A`: * It is not `CLASS_C` because the patch explicitly prevents a returned dangling reference from surviving object lifetime. * It is not `CLASS_A` because no controlled reclaim, object substitution, arbitrary write, security-boundary bypass, disclosure, or demonstrated privilege escalation is established. The demonstrated security-relevant consequence is a potential stale post-lifetime reference in kernel ACPICA state. A kernel crash is plausible if the stale reference is later dereferenced, but it is not directly demonstrated in the supplied material. Privilege escalation, confidentiality impact, and integrity impact remain speculative and are not scored. `ImportantCandidate=NO` is appropriate because this is a teardown-oriented UAF without evidence of meaningful reuse or post-free structured consumption. `AutoDowngradeAllowed=YES` is appropriate under this scoring model because the visible evidence supports a constrained Class B lifetime defect, not unresolved controlled corruption. Manual review remains recommended to inspect the callers that consume `return_desc` after control-method termination and to determine whether platform-specific AML reachability lowers the actual privilege requirement. Likely operational severity is Borderline or ordinary Actionable Moderate depending on the downstream use site and whether untrusted or user-triggerable AML execution is possible in the evaluated product. ## 5. One-sentence report phrase A returned ACPICA RefOf object can retain a reference to method-local or argument storage after the control-method walk state is destroyed, creating a kernel use-after-free condition whose practical reachability and post-free use require further review. ## 6. Manual review recommendation MANUAL CHECK RECOMMENDED The patch directly establishes a real UAF, but the supplied context does not show the later stale-use caller, the actual crash behavior, attacker control over AML input, or a controlled reuse primitive. ## 7. Call-site confidence Call-site confidence: medium ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() [ Upstream Commit: fe7b3d3b7490c2c0119f2d84fa33996dcbc71042 Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fe7b3d3b7490c2c0119f2d84fa33996dcbc71042 Changed files: drivers/acpi/acpica/dsmethod.c Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fe7b3d3b7490c2c0119f2d84fa33996dcbc71042 ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-97455 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97455 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS vector: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H The Best / paranoid CVSS score: 6.4 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: unknown Paranoid ActionableScore: 4 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: MODERATE KPANIC detected for this report: NO Published priority for this report (same as in Subject): MODERATE REGULAR These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).