CVE-2026-100072

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100072", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.456Z", "datePublished": "2026-09-25T13:06:45.579Z", "dateUpdated": "2026-10-21T12:38:45.183Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:38:45.183Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: platform: Use acpi_bus_get_primary_device()\n\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\n\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\n\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/acpi/acpi_platform.c"], "versions": [{"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380", "lessThan": "a75e5de593ef158feb17989bff7730c5a3d82503", "status": "affected", "versionType": "git"}, {"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380", "lessThan": "527a497fb2ef77a95170eefe2007e2c4c957bd2c", "status": "affected", "versionType": "git"}, {"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380", "lessThan": "c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71", "status": "affected", "versionType": "git"}, {"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380", "lessThan": "a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/acpi/acpi_platform.c"], "versions": [{"version": "4.6", "status": "affected"}, {"version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503"}, {"url": "https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c"}, {"url": "https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71"}, {"url": "https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"}], "title": "ACPI: platform: Use acpi_bus_get_primary_device()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/acpi/acpi_platform.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a75e5de593ef158feb17989bff7730c5a3d82503", "status": "affected", "version": "3b95bd160547f56a68aeb972c33ae9511e7a8380", "versionType": "git"}, {"lessThan": "527a497fb2ef77a95170eefe2007e2c4c957bd2c", "status": "affected", "version": "3b95bd160547f56a68aeb972c33ae9511e7a8380", "versionType": "git"}, {"lessThan": "c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71", "status": "affected", "version": "3b95bd160547f56a68aeb972c33ae9511e7a8380", "versionType": "git"}, {"lessThan": "a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd", "status": "affected", "version": "3b95bd160547f56a68aeb972c33ae9511e7a8380", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/acpi/acpi_platform.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD82E339-AFE4-4D6E-AE7F-BC26398AF217", "versionEndExcluding": "7.2.6", "versionStartIncluding": "4.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: platform: Use acpi_bus_get_primary_device()\n\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\n\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\n\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function."}], "id": "CVE-2026-100072", "lastModified": "2026-10-21T18:49:49.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-09-25T14:17:13.700", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ACPI: platform: Use acpi_bus_get_primary_device()", "id": "2541429", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541429"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nACPI: platform: Use acpi_bus_get_primary_device()\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function.", "A flaw was found in the Linux kernel's ACPI (Advanced Configuration and Power Interface) subsystem. This vulnerability can lead to a Denial of Service (DoS) or system instability due to unsafe reference handling during platform device creation. Because the kernel fails to acquire a reference to the physical device node, the device could be freed while still being accessed. A local user could trigger this use-after-free condition to crash the system."], "name": "CVE-2026-100072", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-100072\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100072\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-100072.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b95bd160547f56a68aeb972c33ae9511e7a8380,c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b95bd160547f56a68aeb972c33ae9511e7a8380,a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T19:30:20.141617+00:00", "updated": "2026-10-23T00:45:13.605149+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}