CVE-2026-23443

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23443", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.018Z", "datePublished": "2026-04-03T15:15:27.698Z", "dateUpdated": "2026-05-11T22:07:00.396Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:07:00.396Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: processor: Fix previous acpi_processor_errata_piix4() fix\n\nAfter commi f132e089fe89 (\"ACPI: processor: Fix NULL-pointer dereference\nin acpi_processor_errata_piix4()\"), device pointers may be dereferenced\nafter dropping references to the device objects pointed to by them,\nwhich may cause a use-after-free to occur.\n\nMoreover, debug messages about enabling the errata may be printed\nif the errata flags corresponding to them are unset.\n\nAddress all of these issues by moving message printing to the points\nin the code where the errata flags are set."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/acpi/acpi_processor.c"], "versions": [{"version": "06724a60cfa9767ea90b0f5d3dfb5cdd251b64f5", "lessThan": "68408e8f9e366ad9850a66ac65cb569f13bf6cd4", "status": "affected", "versionType": "git"}, {"version": "ad86ac604f8391c0212a91412d4f764c7a85f254", "lessThan": "2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2", "status": "affected", "versionType": "git"}, {"version": "01e8751b37a366b1ca561add0042f2ceb18c03bf", "lessThan": "edf4c2aaee08e8fd503fbae705c801e92a0b55d7", "status": "affected", "versionType": "git"}, {"version": "b803811485ac0b2f774b6bf3abc8b999ba3b7033", "lessThan": "e0c470049344e9346fff79d7e2362212c216665e", "status": "affected", "versionType": "git"}, {"version": "29f60d3d06818d40118a30d663231f027ae87a05", "lessThan": "98473309a36acc271009b85e0bb53a4c0dddf5c2", "status": "affected", "versionType": "git"}, {"version": "0398b641be2b66c2fc7e0163c606ef19372e7ad5", "lessThan": "8583f62259e1b315d5239371adfb36939cdab741", "status": "affected", "versionType": "git"}, {"version": "f132e089fe89cadc2098991f0a3cb05c3f824ac6", "lessThan": "bf504b229cb8d534eccbaeaa23eba34c05131e25", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/acpi/acpi_processor.c"], "versions": [{"version": "5.15.202", "lessThan": "5.15.203", "status": "affected", "versionType": "semver"}, {"version": "6.1.165", "lessThan": "6.1.167", "status": "affected", "versionType": "semver"}, {"version": "6.6.128", "lessThan": "6.6.130", "status": "affected", "versionType": "semver"}, {"version": "6.12.75", "lessThan": "6.12.78", "status": "affected", "versionType": "semver"}, {"version": "6.18.16", "lessThan": "6.18.20", "status": "affected", "versionType": "semver"}, {"version": "6.19.6", "lessThan": "6.19.10", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.202", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.165", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.128", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.75", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.16", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.6", "versionEndExcluding": "6.19.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/68408e8f9e366ad9850a66ac65cb569f13bf6cd4"}, {"url": "https://git.kernel.org/stable/c/2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2"}, {"url": "https://git.kernel.org/stable/c/edf4c2aaee08e8fd503fbae705c801e92a0b55d7"}, {"url": "https://git.kernel.org/stable/c/e0c470049344e9346fff79d7e2362212c216665e"}, {"url": "https://git.kernel.org/stable/c/98473309a36acc271009b85e0bb53a4c0dddf5c2"}, {"url": "https://git.kernel.org/stable/c/8583f62259e1b315d5239371adfb36939cdab741"}, {"url": "https://git.kernel.org/stable/c/bf504b229cb8d534eccbaeaa23eba34c05131e25"}], "title": "ACPI: processor: Fix previous acpi_processor_errata_piix4() fix", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/acpi/acpi_processor.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "68408e8f9e366ad9850a66ac65cb569f13bf6cd4", "status": "affected", "version": "06724a60cfa9767ea90b0f5d3dfb5cdd251b64f5", "versionType": "git"}, {"lessThan": "2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2", "status": "affected", "version": "ad86ac604f8391c0212a91412d4f764c7a85f254", "versionType": "git"}, {"lessThan": "edf4c2aaee08e8fd503fbae705c801e92a0b55d7", "status": "affected", "version": "01e8751b37a366b1ca561add0042f2ceb18c03bf", "versionType": "git"}, {"lessThan": "e0c470049344e9346fff79d7e2362212c216665e", "status": "affected", "version": "b803811485ac0b2f774b6bf3abc8b999ba3b7033", "versionType": "git"}, {"lessThan": "98473309a36acc271009b85e0bb53a4c0dddf5c2", "status": "affected", "version": "29f60d3d06818d40118a30d663231f027ae87a05", "versionType": "git"}, {"lessThan": "8583f62259e1b315d5239371adfb36939cdab741", "status": "affected", "version": "0398b641be2b66c2fc7e0163c606ef19372e7ad5", "versionType": "git"}, {"lessThan": "bf504b229cb8d534eccbaeaa23eba34c05131e25", "status": "affected", "version": "f132e089fe89cadc2098991f0a3cb05c3f824ac6", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/acpi/acpi_processor.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5.15.203", "status": "affected", "version": "5.15.202", "versionType": "semver"}, {"lessThan": "6.1.167", "status": "affected", "version": "6.1.165", "versionType": "semver"}, {"lessThan": "6.6.130", "status": "affected", "version": "6.6.128", "versionType": "semver"}, {"lessThan": "6.12.78", "status": "affected", "version": "6.12.75", "versionType": "semver"}, {"lessThan": "6.18.20", "status": "affected", "version": "6.18.16", "versionType": "semver"}, {"lessThan": "6.19.10", "status": "affected", "version": "6.19.6", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D54E2FD5-7EF9-426A-9AE1-8E8DA970BCC8", "versionEndExcluding": "6.1.167", "versionStartIncluding": "6.1.165", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2099D3D0-97C6-44C5-913D-E616B07A9237", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.6.128", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DAB9F88E-FB55-4FDB-966E-E7FC262B2038", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.12.75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "234D2F07-A17A-49BE-8B89-9C6756315A38", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.18.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20A592B7-9A05-4B02-A583-F1B95CD93223", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15.202:*:*:*:*:*:*:*", "matchCriteriaId": "822A7BB5-FF38-425A-B8A8-9F102CF92C36", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: processor: Fix previous acpi_processor_errata_piix4() fix\n\nAfter commi f132e089fe89 (\"ACPI: processor: Fix NULL-pointer dereference\nin acpi_processor_errata_piix4()\"), device pointers may be dereferenced\nafter dropping references to the device objects pointed to by them,\nwhich may cause a use-after-free to occur.\n\nMoreover, debug messages about enabling the errata may be printed\nif the errata flags corresponding to them are unset.\n\nAddress all of these issues by moving message printing to the points\nin the code where the errata flags are set."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nACPI: processor: Corrige la correcci\u00f3n anterior de acpi_processor_errata_piix4()\n\nDespu\u00e9s del commit f132e089fe89 ('ACPI: processor: Corrige la desreferenciaci\u00f3n de puntero NULL en acpi_processor_errata_piix4()'), los punteros de dispositivo pueden ser desreferenciados despu\u00e9s de eliminar las referencias a los objetos de dispositivo a los que apuntan, lo que puede causar un uso despu\u00e9s de liberaci\u00f3n.\n\nAdem\u00e1s, los mensajes de depuraci\u00f3n sobre la habilitaci\u00f3n de las erratas pueden imprimirse si las banderas de errata correspondientes a ellas no est\u00e1n establecidas.\n\nAborda todos estos problemas moviendo la impresi\u00f3n de mensajes a los puntos en el c\u00f3digo donde las banderas de errata est\u00e1n establecidas."}], "id": "CVE-2026-23443", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-03T16:16:28.573", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/68408e8f9e366ad9850a66ac65cb569f13bf6cd4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8583f62259e1b315d5239371adfb36939cdab741"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/98473309a36acc271009b85e0bb53a4c0dddf5c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bf504b229cb8d534eccbaeaa23eba34c05131e25"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e0c470049344e9346fff79d7e2362212c216665e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/edf4c2aaee08e8fd503fbae705c801e92a0b55d7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ACPI: processor: Fix previous acpi_processor_errata_piix4() fix", "id": "2454856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454856"}, "csaw": false, "details": ["A flaw was found in the Linux kernel's ACPI (Advanced Configuration and Power Interface) processor errata handling. This vulnerability occurs when device pointers are dereferenced after their corresponding device objects have been freed. This can lead to a use-after-free condition, potentially resulting in system instability or a denial of service."], "name": "CVE-2026-23443", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23443\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23443\nhttps://lore.kernel.org/linux-cve-announce/2026040314-CVE-2026-23443-19e2@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ad86ac604f8391c0212a91412d4f764c7a85f254,2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[01e8751b37a366b1ca561add0042f2ceb18c03bf,edf4c2aaee08e8fd503fbae705c801e92a0b55d7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b803811485ac0b2f774b6bf3abc8b999ba3b7033,e0c470049344e9346fff79d7e2362212c216665e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[29f60d3d06818d40118a30d663231f027ae87a05,98473309a36acc271009b85e0bb53a4c0dddf5c2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0398b641be2b66c2fc7e0163c606ef19372e7ad5,8583f62259e1b315d5239371adfb36939cdab741)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f132e089fe89cadc2098991f0a3cb05c3f824ac6,bf504b229cb8d534eccbaeaa23eba34c05131e25)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "06724a60cfa9767ea90b0f5d3dfb5cdd251b64f5"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0-rc1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0-rc1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T03:25:36.738238+00:00", "value": {"mitigation_remediation": ["Upgrade the kernel to the latest version supplied by your distribution that includes the acpi_processor_errata_piix4 fix.", "Reboot the system to load the updated kernel and fully apply the fix.", "If the available distribution kernels are outdated, obtain the upstream patch that resolves the use\u2011after\u2011free and integrate or backport it to the installed kernel."], "summary": {"action": "Patch Now", "impact": "Use-after\u2011free in kernel ACPI processor code"}, "threat_synthesis": {"affected_systems": "All Linux kernel versions that include the ACPI processor errata logic before the mentioned upstream commit are affected. The change applies to kernel releases that contain the acpi_processor_errata_piix4 function, which are all kernels up to the point where the patch was integrated. Operators should verify whether their deployed kernel incorporates this fix.", "description_and_impact": "The Linux kernel contains a flaw in the ACPI processor errata handling routine that may cause a use\u2011after\u2011free when a device pointer is dereferenced after the kernel has released its reference to the underlying device object. This flaw is a classic null\u2011pointer dereference that can corrupt kernel memory and, if successfully exploited, could lead to kernel panic or privilege escalation.", "risk_and_exploitability": "The CVSS score of 5.5 indicates a moderate severity. The EPSS score of less than\u202f1\u202f% suggests a low current likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation would require the attacker to trigger the faulty code path in kernel mode, most likely through local or privilege\u2011elevated access. No publicly available exploits are currently documented, but successful exploitation could disrupt the affected system or provide a foothold for higher\u2011privilege attacks."}}}}, "created": "2026-04-03T21:13:55.094637+00:00", "updated": "2026-04-29T03:30:15.944031+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}