CVE-2026-92521

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface (ACPI) PCI subsystem. This use-after-free vulnerability occurs because the driver_data pointer is not properly cleared when an acpi_pci_root object is freed during certain error handling paths or removal operations. A local attacker could potentially exploit this condition by triggering these specific scenarios, leading to a system crash (Denial of Service).

A stale device driver_data pointer can remain after acpi_pci_root_add fails or after acpi_pci_root_remove frees an acpi_pci_root object. A later acpi_pci_find_root call may dereference the freed object and cause a kernel use after free. The confirmed impact is at least kernel crash or ACPI PCI hotplug failure. The worst case may include kernel memory corruption if the dangling object is reused before a later dereference. For the CVSS the PR:H is used because reliable triggering normally requires administrative control of PCI or ACPI hotplug operations or control of the relevant hardware firmware or virtual platform. The issue is not directly network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.