CVE-2026-97455

A flaw was found in the Linux kernel's ACPI (Advanced Configuration and Power Interface) Component Architecture (ACPICA). When terminating a control method, references to method local variables and arguments are not properly cleared, leading to a use-after-free condition when internal execution state is deleted. A local attacker could exploit this vulnerability to cause kernel memory corruption, resulting in a denial of service (DoS) or potential privilege escalation.

A use-after-free flaw was found in the Linux kernel's ACPI Component Architecture (ACPICA) implementation, in acpi_ds_terminate_control_method() (drivers/acpi/acpica/dsmethod.c). When an ACPI control method that returned a reference to one of its local variables or arguments is terminated, those references are not cleared before the method's walk state and associated internal objects are deleted, leaving a dangling pointer that can later be used to access freed kernel memory. Red Hat rates this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): successful exploitation causes kernel memory corruption that results in a kernel panic and denial of service. Exploitation requires local access, and reliable triggering generally requires control over the ACPI machine language (AML) being interpreted, which typically requires administrative privileges to supply or override ACPI tables; impact beyond denial of service has not been demonstrated. For this reason the Red Hat severity is lower than the upstream CVEORG rating of 8.4, which assumes no privileges and high confidentiality, integrity, and availability impact that the available evidence does not establish. Red Hat Enterprise Linux 6 is no longer in active support and is marked out of support scope, while the kernel and kernel-rt packages in Red Hat Enterprise Linux 7 through 10, the kernel components of Red Hat In-Vehicle OS 2, and the RHEL CoreOS-based nodes in OpenShift Container Platform 4 and 5 are affected. Fixes for the affected streams are deferred to a future update because this is a moderate-severity local denial-of-service issue with limited practical exploitability; the residual risk is that a local attacker able to influence ACPI control method evaluation could crash the system, with privilege escalation considered unlikely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.