---
id: CVE-2026-92522
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ACPI: processor: validate MADT IOAPIC entry bounds

  The IOAPIC hotplug lookup parses both MADT and _MAT records directly.
  The MADT walk previously used a subtable's dec…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ACPI: processor: validate MADT IOAPIC entry bounds

  The IOAPIC hotplug lookup parses both MADT and _MAT records directly.
  The MADT walk previously used a subtable's dec…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    5601bd81bc290a724ed47797d22c16cba4d7ed9f
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    ff82e3374e9103d046b2a82f4315d9a422ff097d
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    2a5520065e76000f8c979d3d7b3d861ccaaecf1e
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    8e67b58c04990817ac2dbf8ae03353be6a358cd4
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    74d84320f8e37955eb286a7777843d554e6e75b2
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    4d8ecaa332c163f2b44aa5027bf061950b71b5f3
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    355bee5f11acb116cd256588631b4028ca562646
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    2c50ffdc73f3a70d745d249f509fc290754121e6
  - Linux 4.0
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:18:14.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92522'
references:
  - url: 'https://git.kernel.org/stable/c/2a5520065e76000f8c979d3d7b3d861ccaaecf1e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2c50ffdc73f3a70d745d249f509fc290754121e6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/355bee5f11acb116cd256588631b4028ca562646'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d8ecaa332c163f2b44aa5027bf061950b71b5f3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5601bd81bc290a724ed47797d22c16cba4d7ed9f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/74d84320f8e37955eb286a7777843d554e6e75b2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8e67b58c04990817ac2dbf8ae03353be6a358cd4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ff82e3374e9103d046b2a82f4315d9a422ff097d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92522.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92522'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536537'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92522'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92522'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-92522.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00137
epssPercentile: 0.03078
ingestedAt: '2026-09-17T16:21:47.776Z'
cwe:
  - CWE-805
scores:
  nvd: 7.3
  vendor: 5.5
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ACPI: processor: validate MADT IOAPIC entry bounds

The IOAPIC hotplug lookup parses both MADT and _MAT records directly.
The MADT walk previously used a subtable's declared length to advance
the cursor after only locating a generic header.  The _MAT path likewise
passed a generic header to the IOAPIC helper.

Validate that a current record has a complete generic header, that its
declared length is contained in the available record range, and that a
typed IOAPIC record contains the full fixed IOAPIC body before reading
its fields.  Use the same relation for both MADT and _MAT provider
paths.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92522.json)