CVE-2026-93251

A flaw was found in the Linux kernel's ACPI (Advanced Configuration and Power Interface) subsystem. Due to improper synchronization during physical device lookups, a race condition can occur when a device is unbound concurrently. A local user could exploit this timing flaw to cause a use-after-free condition, accessing memory that has already been released. This flaw can lead to a system crash, resulting in a Denial of Service (DoS) or potentially arbitrary code execution.

This vulnerability is rated as Moderate severity because exploitation requires local access and precise timing during device unbinding operations, limiting the impact primarily to a denial of service. While ACPI is universally active across standard enterprise server deployments, triggering the synchronization race condition typically depends on physical hot-unplug events or privileged driver detachment. Consequently, unprivileged local users face substantial barriers to reliably achieving arbitrary code execution rather than causing a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.