CVE-2026-92521
Description
In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root acpi_pci_root_add() assigns the freshly allocated root to device->driver_data before dmar_device_add() and pci_acpi_scan_root(). Both failure paths reach the end: label where root is kfree()'d, but only the pci_acpi_scan_root() path clears driver_data first. When dmar_device_add() fails during a hot-add, root is freed while device->driver_data still points at it. The ACPI core does not clear driver_data on attach failure, so a later acpi_pci_find_root() call may dereference this dangling pointer. acpi_pci_root_remove() has the same problem: it frees root without clearing device->driver_data, leaving a dangling pointer behind after the root bridge is removed. Move the NULL assignment to the shared end: label so every error path in acpi_pci_root_add() clears driver_data before freeing root, and clear it in acpi_pci_root_remove() as well, so the object is never left reachable through driver_data after being freed.
How to fix
- Linux Linux321bb0eb1486a0d575f02e24e3f4170e408c2f51, 3c1e8a14f9d06c1ed6f3e4bd2d283a62079109e2, a285fa3780c768dcc51c76768707d099a2cc611d, 6aaf6dbf54fdfae096f3f90a79e9614e46579280, 70cf773cca30a10b4964c24520a71279c974b899, 3eee4c21931dc048ce63b86809f04e4e6f0dcad5, 6e11ac626f9f9fc3a2ed27dfa44ccbe5fb762217, 8a742141f7ab84975aa758b775567ef4740ef0cf or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 ≤ v < 321bb0eb1486a0d575f02e24e3f4170e408c2f51, db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 ≤ v < 3c1e8a14f9d06c1ed6f3e4bd2d283a62079109e2, db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 ≤ v < a285fa3780c768dcc51c76768707d099a2cc611d, db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 ≤ v < 6aaf6dbf54fdfae096f3f90a79e9614e46579280, db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 ≤ v < 70cf773cca30a10b4964c24520a71279c974b899, db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 ≤ v < 3eee4c21931dc048ce63b86809f04e4e6f0dcad5, db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 ≤ v < 6e11ac626f9f9fc3a2ed27dfa44ccbe5fb762217, db89b4f0dbab837d0f3de2c3e9427a8d5393afa3 ≤ v < 8a742141f7ab84975aa758b775567ef4740ef0cf, 2.6.28 | 321bb0eb1486a0d575f02e24e3f4170e408c2f51, 3c1e8a14f9d06c1ed6f3e4bd2d283a62079109e2, a285fa3780c768dcc51c76768707d099a2cc611d, 6aaf6dbf54fdfae096f3f90a79e9614e46579280, 70cf773cca30a10b4964c24520a71279c974b899, 3eee4c21931dc048ce63b86809f04e4e6f0dcad5, 6e11ac626f9f9fc3a2ed27dfa44ccbe5fb762217, 8a742141f7ab84975aa758b775567ef4740ef0cf |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.