CVE-2026-92521

CVE CVE-2026-92521EUVD EUVD-2026-82142Published 2026-09-17T16:10:28.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root acpi_pci_root_add() assigns the freshly allocated root to device->driver_data before dmar_device_add() and pci_acpi_scan_root(). Both failure paths reach the end: label where root is kfree()'d, but only the pci_acpi_scan_root() path clears driver_data first. When dmar_device_add() fails during a hot-add, root is freed while device->driver_data still points at it. The ACPI core does not clear driver_data on attach failure, so a later acpi_pci_find_root() call may dereference this dangling pointer. acpi_pci_root_remove() has the same problem: it frees root without clearing device->driver_data, leaving a dangling pointer behind after the root bridge is removed. Move the NULL assignment to the shared end: label so every error path in acpi_pci_root_add() clears driver_data before freeing root, and clear it in acpi_pci_root_remove() as well, so the object is never left reachable through driver_data after being freed.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 2.6.28; patch: 7.3-rc1; db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 <70cf773cca30a10b4964c24520a71279c974b899; patch: 5.10.270; patch: 6.6.157; patch: 6.1.188; db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 <a285fa3780c768dcc51c76768707d099a2cc611d; db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 <6aaf6dbf54fdfae096f3f90a79e9614e46579280; db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 <8a742141f7ab84975aa758b775567ef4740ef0cf; patch: 5.15.221; db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 <3eee4c21931dc048ce63b86809f04e4e6f0dcad5; db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 <321bb0eb1486a0d575f02e24e3f4170e408c2f51; patch: 7.2.6; patch: 6.12.110; patch: 6.18.52; db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 <3c1e8a14f9d06c1ed6f3e4bd2d283a62079109e2; patch: 0; db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 <6e11ac626f9f9fc3a2ed27dfa44ccbe5fb762217

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.