{"id":"CVE-2026-89436","revision":"a26aff7b84dd4ddb94f95491b85fec3f","records":[{"revision":"a26aff7b84dd4ddb94f95491b85fec3f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89436","aliases":[],"title":"platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]\n\nacpi_pcc_retrieve_biosdata() rejects SINF packages only when\npcc->num_sifr is strictly less than hkey->package.count, then\nunconditionally writes a trailing sentinel at\npcc->sinf[hkey->package.count]. But pcc->sinf[] is allocated with\nexactly pcc->num_sifr elements (valid indices 0..num_sifr-1), so that\nwrite needs num_sifr strictly greater than package.count to stay in\nbounds -- num_sifr == package.count passes the existing check but\nstill overflows by one element.\n\nThis is exactly the case probe()'s existing num_sifr++ workaround\n(\"Some DSDT-s have an off-by-one bug where the SINF package count is\none higher than the SQTY reported value\") is written to accommodate:\nwhen a DSDT's SINF package count equals SQTY+1, the workaround makes\nnum_sifr equal to package.count, which is precisely the boundary that\noverflows here. Found via UBSan (array-index-out-of-bounds) on\nhardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38\nelements: num_sifr becomes 38 after the += 1 workaround, the loop\ncorrectly fills indices 0..37, and the sentinel write then targets\nindex 38, one past the end -- a silent 4-byte heap overflow on kernels\nwithout CONFIG_UBSAN.\n\nTightening the rejection check to num_sifr <= package.count would\navoid the overflow but breaks probe() entirely on exactly this\nhardware, since num_sifr == package.count is the case the off-by-one\nworkaround exists to support. Nothing else in the driver reads this\nsentinel value back, so simply skip the write when there is no room\nfor it instead.","state":0,"publishedAt":"2026-09-11T19:43:06.732+00:00","modifiedAt":"2026-10-19T08:46:44.75+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/platform/x86/panasonic-laptop.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a3d0dbd18ce908292607bb6cf37c978ece8a33d4\",\n                            \"lessThan\": \"a93df956ee4d903735b6d395362c839cb1dc07e3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3d0dbd18ce908292607bb6cf37c978ece8a33d4\",\n                            \"lessThan\": \"329f10d8be193bf36af124e00b9dd6644cd71724\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/platform/x86/panasonic-laptop.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/a93df956ee4d903735b6d395362c839cb1dc07e3","https://git.kernel.org/stable/c/329f10d8be193bf36af124e00b9dd6644cd71724"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89436","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89436","identifiers":["CVE-2026-89436"]},"retained":false,"historicalAffected":[]}],"coverage":[]}