CVE-2026-97448

A flaw was found in the Linux kernel's ACPI Component Architecture (ACPICA) subsystem. The acpi_ns_build_normalized_path() function fails to validate namespace nodes before processing them, leading to a use-after-free condition. A local user could exploit this flaw to cause a Denial of Service (DoS) or potentially escalate privileges on the system.

A use-after-free flaw of Moderate impact was found in the Linux kernel ACPICA subsystem as packaged in Red Hat products. The acpi_ns_build_normalized_path() function in drivers/acpi/acpica/nsnames.c does not validate an ACPI namespace node before processing it, so a node whose descriptor has already been freed can be dereferenced while a normalized namespace path is being built. A local user who can trigger the affected ACPI namespace operation on a vulnerable system could use this flaw to cause a denial of service (kernel crash) or potentially escalate privileges. Red Hat rates this flaw as Moderate impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local, authenticated access and the most likely practical consequence is loss of availability; this is lower than the CVE.org score of 7.7 High, which assumes no privileges are required and a high confidentiality impact. Affected Red Hat offerings include Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and the RHEL CoreOS 8/9-based nodes shipped with OpenShift Container Platform 4 and 5. Fixes for the affected streams are currently deferred and are expected to be delivered in future scheduled kernel updates; the residual risk is that a local authenticated attacker could crash the system or, less likely, escalate privileges through memory corruption. Red Hat Enterprise Linux 7 Extended Lifecycle Support is not affected because the vulnerable code is not present in that code stream, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope for this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.