CVE-2026-97456

A flaw was found in the Linux kernel's ACPI Component Architecture (ACPICA) AML parser, rated Moderate impact by Red Hat Product Security (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). In acpi_ps_parse_loop() (drivers/acpi/acpica/psloop.c), the parser checks for the AML_ELSE_OP opcode without first verifying that it has not reached the end of the AML buffer, which allows an out-of-bounds memory read when the kernel parses crafted ACPI Machine Language (AML) bytecode. An attacker who can supply crafted ACPI tables to the system, for example through control of platform firmware, an ACPI table override, or equivalent administrative control over the boot environment, could trigger a kernel crash, resulting in a denial of service. In virtualized deployments the guest kernel can consume ACPI tables supplied by the virtual firmware provider, which is normally within the host-to-guest trust boundary. The demonstrated flaw is an out-of-bounds read, not a write, and no information disclosure path has been demonstrated.

Affected Red Hat products are Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), and OpenShift Container Platform releases built on RHEL CoreOS 8 and RHEL CoreOS 9. On these streams the fix is currently deferred rather than shipped as an immediate update; the residual risk of that delay is limited to a potential kernel crash (denial of service), since exploitation requires an attacker to already control the ACPI table content supplied to the kernel. Red Hat Enterprise Linux 7 Extended Lifecycle Support is not affected because the vulnerable code is not present, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope for this flaw.