All vulnerabilities
CVE-2026-100072

Linux: ACPI: platform: Use acpi_bus_get_primary_device()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in527a497fb2ef77a95170eefe2007e2c4c957bd2cFixed versionCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 527a497fb2ef77a95170eefe2007e2c4c957bd2cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: platform: Use acpi_bus_get_primary_device()

The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is generally unsafe because in theory the device returned by it may be freed at any time [1].

It is also inefficient because acpi_get_first_physical_node() is called multiple times for the same argument which can be avoided.

Address these issues by using acpi_bus_get_primary_device() instead of acpi_get_first_physical_node() and adjusting the code to call it just once at the beginning of and acpi_create_platform_device() and drop the device reference acquired by it upon the return from that function.

Text from CVE List

Affected versions 10

  • Linuxaffected: 3b95bd160547f56a68aeb972c33ae9511e7a8380 before a75e5de593ef158feb17989bff7730c5a3d82503CVE List
  • Linuxaffected: 3b95bd160547f56a68aeb972c33ae9511e7a8380 before 527a497fb2ef77a95170eefe2007e2c4c957bd2cCVE List
  • Linuxaffected: 3b95bd160547f56a68aeb972c33ae9511e7a8380 before c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71CVE List
  • Linuxaffected: 3b95bd160547f56a68aeb972c33ae9511e7a8380 before a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bdCVE List
  • Linuxaffected: 4.6CVE List
  • Linuxunaffected: all versions before 4.6CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4