CVE-2026-68325

A flaw was found in the Linux kernel's ivrs_acpihid command-line parser. This vulnerability occurs because the parser does not properly bound the early_acpihid_map array, allowing it to append more entries than its fixed four-element capacity. A local attacker could exploit this out-of-bounds write to cause a denial of service or potentially execute arbitrary code.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because triggering it requires the ability to supply or modify kernel boot parameters, restricting potential exploit avenues to privileged administrative users or environments with bootloader access. In standard Red Hat deployments, the ivrs_acpihid parameter is not configured by default. An unprivileged local attacker cannot inject boot options into a running system, significantly limiting the operational risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.