CVE-2026-97451

A flaw was found in the Linux kernel's ACPICA (Advanced Configuration and Power Interface Component Architecture) subsystem. An integer overflow occurs when calculating string or buffer truncation lengths during ACPI operation processing. A local attacker could exploit this vulnerability to trigger an invalid size calculation in memory copy routines, resulting in out-of-bounds memory access, a kernel crash, and a Denial of Service (DoS).

A flaw was found in the Linux kernel's ACPICA subsystem, rated MODERATE by Red Hat Product Security, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux, the kernel packages in Red Hat In-Vehicle OS, and the RHEL CoreOS 8 and 9 kernels shipped with OpenShift Container Platform. When the ACPICA code processes the ACPI Mid operator in acpi_ex_opcode_3A_1T_1R(), an integer overflow in the calculation of Index + Length used for string or buffer truncation can produce a negative size that is passed to memcpy(), resulting in an out-of-bounds memory access. A local attacker able to cause malicious or malformed ACPI machine language (AML) to be evaluated, for example through control over ACPI tables, firmware, or a privileged table-loading mechanism, could use this flaw to crash the kernel and cause a denial of service. No confidentiality or integrity impact has been demonstrated. The RHEL 6 ELS kernel is marked out of support and will not receive a fix; the fixes for the in-support affected products are deferred to a future update, and the residual risk while the fix is deferred is limited to local denial of service. The upstream kernel CVE record assigns a higher severity of 8.4 (AV:L/AC:L/PR:N/C:H/I:H/A:H) than Red Hat's rating of 5.5 MODERATE (AV:L/AC:L/PR:L/C:N/I:N/A:H); Red Hat's rating reflects that exploitation requires local access with privileges and control over AML evaluation, and that the demonstrated impact is denial of service rather than data compromise or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.