CVE-2026-80593

A flaw was found in the Linux kernel, specifically within the hwmon (hardware monitoring) subsystem's asus_atk0110 driver. This vulnerability occurs because the atk_ec_present() function does not properly check the size of a data package before attempting to read its contents. A local attacker could exploit this by providing a specially crafted firmware package, which could lead to an out-of-bounds read. This could result in information disclosure or potentially cause system instability.

A low impact out-of-bounds read flaw was found in the Linux kernel hwmon subsystem's asus_atk0110 driver, which is shipped in Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm). The atk_ec_present() function walks the management group package returned by the ACPI GGRP method and reads the first element of each sub-package without first checking that the sub-package is non-empty. A local attacker who can supply a specially crafted ACPI firmware package on affected systems could trigger a read past the end of the allocated element array, resulting in information disclosure or system instability such as a kernel panic. Because triggering the flaw requires malformed ACPI firmware presenting a zero-element sub-package within the ATK0110 management group, and the flaw is limited to a read, the affected components are recorded as affected with the fix deferred to a future scheduled maintenance update; the residual risk until the fix lands is limited to potential information disclosure or a denial of service on hardware whose firmware exposes such malformed packages. Red Hat's severity assessment for this flaw is lower than the upstream CVEORG score of 8.4: an out-of-bounds read of an ACPI package element array does not plausibly yield the high confidentiality and integrity impacts claimed by the upstream vector, and the realistic consequence is primarily availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.