In the Linux kernel, the following vulnerability has been resolved:
hwmon: (asus_atk0110) Check package count before accessing element
atk_ec_present() walks the management group package returned by the GGRP
ACPI method and, for each sub-package, reads its first element:
id = &obj->package.elements[0];
if (id->type != ACPI_TYPE_INTEGER)
without checking that the sub-package is non-empty. ACPICA allocates the
element array with exactly package.count entries, so for a sub-package
with a zero count this reads past the allocation.
The sibling function atk_debugfs_ggrp_open() performs the same access but
skips empty packages with a package.count check first. Add the same
check to atk_ec_present() so a malformed firmware package cannot trigger
an out-of-bounds read.
References
Configurations
No configuration.
History
No history.
Information
Published : 2026-08-28 08:16
Updated : 2026-08-29 07:16
NVD link : CVE-2026-80593
Mitre link : CVE-2026-80593
CVE.ORG link : CVE-2026-80593
JSON object : View
Products Affected
No product.
CWE
No CWE.