CVE-2026-89587

A flaw was found in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) component. The query_capability() function, responsible for handling ACPI buffer objects from firmware, performs an unchecked memory copy operation. If the firmware provides an oversized buffer, a stack buffer overflow occurs, leading to memory corruption. This could allow a local attacker to cause a denial of service or potentially execute arbitrary code.

A stack based buffer overflow exists in the ACPI pfr_update query_capability path because firmware supplied _DSM buffer lengths are used for memcpy into fixed u8(16) fields without checking the destination size. The affected structure is allocated on the kernel stack in pfru_ioctl, so an oversized firmware buffer can corrupt adjacent stack memory and may cause a kernel crash or potentially more serious memory corruption effects. For the CVSS the PR:L value is used for the paranoid score because a local process with access to the PFRU ioctl path may be enough on systems where the device node or a firmware management service is delegated below full administrator control. The issue is not network reachable and depends on local device access plus ACPI firmware returning oversized buffers. Impact is at least local denial of service via kernel memory corruption, and worst case may include confidentiality and integrity impact due to a kernel stack overwrite.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.