https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:38:09 +0000 https://db.gcve.eu/vuln/cve-2026-92521 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root</p> <p>acpi_pci_root_add() assigns the freshly allocated root to device-&gt;driver_data before dmar_device_add() and pci_acpi_scan_root(). Both failure paths reach the end: label where root is kfree()&#39;d, but only the pci_acpi_scan_root() path clears driver_data first.</p> <p>When dmar_device_add() fails during a hot-add, root is freed while device-&gt;driver_data still points at it. The ACPI core does not clear driver_data on attach failure, so a later acpi_pci_find_root() call may dereference this dangling pointer.</p> <p>acpi_pci_root_remove() has the same problem: it frees root without clearing device-&gt;driver_data, leaving a dangling pointer behind after the root bridge is removed.</p> <p>Move the NULL assignment to the shared end: label so every error path in acpi_pci_root_add() clears driver_data before freeing root, and clear it in acpi_pci_root_remove() as well, so the object is never left reachable through driver_data after being freed.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root</p> <p>acpi_pci_root_add() assigns the freshly allocated root to device-&gt;driver_data before dmar_device_add() and pci_acpi_scan_root(). Both failure paths reach the end: label where root is kfree()&#39;d, but only the pci_acpi_scan_root() path clears driver_data first.</p> <p>When dmar_device_add() fails during a hot-add, root is freed while device-&gt;driver_data still points at it. The ACPI core does not clear driver_data on attach failure, so a later acpi_pci_find_root() call may dereference this dangling pointer.</p> <p>acpi_pci_root_remove() has the same problem: it frees root without clearing device-&gt;driver_data, leaving a dangling pointer behind after the root bridge is removed.</p> <p>Move the NULL assignment to the shared end: label so every error path in acpi_pci_root_add() clears driver_data before freeing root, and clear it in acpi_pci_root_remove() as well, so the object is never left reachable through driver_data after being freed.</p> https://db.gcve.eu/vuln/cve-2026-92521