What’s Vulnerable › Vulnerabilities

CVE-2026-23443: ACPI: processor: Fix previous acpi_processor_errata_piix4() fix

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-03 · updated 2026-07-24
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix previous acpi_processor_errata_piix4() fix After commi f132e089fe89 ("ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()"), device pointers may be dereferenced after dropping references to the device objects pointed to by them, which may cause a use-after-free to occur. Moreover, debug messages about enabling the errata may be printed if the errata flags corresponding to them are unset. Address all of these issues by moving message printing to the points in the code where the errata flags are set.

Affected products

• Linux kernel: from 6.1.165 before 6.1.167; from 6.6.128 before 6.6.130; from 6.12.75 before 6.12.78; from 6.18.16 before 6.18.20; from 6.19.6 before 6.19.10; 5.15.202 — fixed in 6.1.167, 6.12.78, 6.18.20, 6.19.10, 6.6.130

How to fix

Upgrade to a fixed version: Linux kernel 6.1.167, 6.12.78, 6.18.20, 6.19.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2
• https://git.kernel.org/stable/c/68408e8f9e366ad9850a66ac65cb569f13bf6cd4
• https://git.kernel.org/stable/c/8583f62259e1b315d5239371adfb36939cdab741
• https://git.kernel.org/stable/c/98473309a36acc271009b85e0bb53a4c0dddf5c2
• https://git.kernel.org/stable/c/bf504b229cb8d534eccbaeaa23eba34c05131e25
• https://git.kernel.org/stable/c/e0c470049344e9346fff79d7e2362212c216665e
• https://git.kernel.org/stable/c/edf4c2aaee08e8fd503fbae705c801e92a0b55d7

Get alerted when CVE-2026-23443 or the next vulnerability affects your stack