CVE-2026-92522

ACPI: processor: validate MADT IOAPIC entry bounds

State: Published
Severity: 7.3 High
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: processor: validate MADT IOAPIC entry bounds

The IOAPIC hotplug lookup parses both MADT and _MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generic header. The _MAT path likewise passed a generic header to the IOAPIC helper.

Validate that a current record has a complete generic header, that its declared length is contained in the available record range, and that a typed IOAPIC record contains the full fixed IOAPIC body before reading its fields. Use the same relation for both MADT and _MAT provider paths.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 5601bd81bc290a724ed47797d22c16cba4d7ed9fAffected ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before ff82e3374e9103d046b2a82f4315d9a422ff097dAffected ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 2a5520065e76000f8c979d3d7b3d861ccaaecf1eAffected ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 8e67b58c04990817ac2dbf8ae03353be6a358cd4Affected ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 74d84320f8e37955eb286a7777843d554e6e75b2Affected ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 4d8ecaa332c163f2b44aa5027bf061950b71b5f3Affected ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 355bee5f11acb116cd256588631b4028ca562646Affected ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 2c50ffdc73f3a70d745d249f509fc290754121e6Affected
LinuxLinux	4.0Affected before 4.0Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 5601bd81bc290a724ed47797d22c16cba4d7ed9fAffected
ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before ff82e3374e9103d046b2a82f4315d9a422ff097dAffected
ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 2a5520065e76000f8c979d3d7b3d861ccaaecf1eAffected
ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 8e67b58c04990817ac2dbf8ae03353be6a358cd4Affected
ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 74d84320f8e37955eb286a7777843d554e6e75b2Affected
ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 4d8ecaa332c163f2b44aa5027bf061950b71b5f3Affected
ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 355bee5f11acb116cd256588631b4028ca562646Affected
ecf5636dcd59cd5508641f995cc4c2bafedbb995 to before 2c50ffdc73f3a70d745d249f509fc290754121e6Affected

LinuxLinux

4.0Affected
before 4.0Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.