---
id: CVE-2026-89587
title: 'ACPI: pfr_update: fix stack buffer overflow in query_capability()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ACPI: pfr_update: fix stack buffer overflow in query_capability()

  query_capability() copies four ACPI buffer objects returned by the
  firmware _DSM into fixed-size u8[1…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-120
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 <
    d3af83e327565a9444cebc0db714cb837e493046
  - >-
    Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 <
    c5a31b4e7e37c92550be9a2edf51ca853a4d251a
  - >-
    Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 <
    a2151624b55029dad0ca7efd17fb83a0461c8843
  - >-
    Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 <
    6d4ed2fd022bc862b156e53aae163b61259e1caa
  - >-
    Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 <
    15d2b7f38f95d28652170344f39ee492c55e567c
  - >-
    Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 <
    ced45be0073a8a31b30b4a7f68cd3a15734515de
  - Linux 5.17
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:49:19.962Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89587'
references:
  - url: 'https://git.kernel.org/stable/c/d3af83e327565a9444cebc0db714cb837e493046'
  - url: 'https://git.kernel.org/stable/c/c5a31b4e7e37c92550be9a2edf51ca853a4d251a'
  - url: 'https://git.kernel.org/stable/c/a2151624b55029dad0ca7efd17fb83a0461c8843'
  - url: 'https://git.kernel.org/stable/c/6d4ed2fd022bc862b156e53aae163b61259e1caa'
  - url: 'https://git.kernel.org/stable/c/15d2b7f38f95d28652170344f39ee492c55e567c'
  - url: 'https://git.kernel.org/stable/c/ced45be0073a8a31b30b4a7f68cd3a15734515de'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89587.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89587'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532213'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89587'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89587'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89587.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00143
epssPercentile: 0.0355
scores:
  cna: 7.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.451Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ACPI: pfr_update: fix stack buffer overflow in query_capability()

query_capability() copies four ACPI buffer objects returned by the
firmware _DSM into fixed-size u8[16] fields in struct
pfru_update_cap_info using memcpy with the firmware-supplied length:

  memcpy(&cap_hdr->code_type,
         elements[CAP_CODE_TYPE_IDX].buffer.pointer,
         elements[CAP_CODE_TYPE_IDX].buffer.length);

The same pattern repeats for drv_type, platform_id, and oem_id.
If the firmware returns buffer.length > 16 for any of these fields,
memcpy writes past the destination array.

struct pfru_update_cap_info is stack-allocated in pfru_ioctl().

Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports
are generated when a DSM returns 64-byte buffers, with writes reaching
44 bytes past the end of cap_hdr's [64, 156) frame window into
adjacent stack redzones.

Introduce a helper pointer to out_obj->package.elements and use it
to validate each buffer length against its destination field size
before copying, returning -EINVAL if the firmware supplies an
oversized buffer.

## Affected

- `Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 < d3af83e327565a9444cebc0db714cb837e493046`
- `Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 < c5a31b4e7e37c92550be9a2edf51ca853a4d251a`
- `Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 < a2151624b55029dad0ca7efd17fb83a0461c8843`
- `Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 < 6d4ed2fd022bc862b156e53aae163b61259e1caa`
- `Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 < 15d2b7f38f95d28652170344f39ee492c55e567c`
- `Linux >= 0db89fa243e5edc5de38c88b369e4c3755c5fb74 < ced45be0073a8a31b30b4a7f68cd3a15734515de`
- `Linux 5.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89587.json)