CVE-2026-80593

Received Received - Intake

Buffer Overflow in Linux Kernel hwmon asus_atk0110 Driver

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count before accessing element atk_ec_present() walks the management group package returned by the GGRP ACPI method and, for each sub-package, reads its first element: id = &obj->package.elements[0]; if (id->type != ACPI_TYPE_INTEGER) without checking that the sub-package is non-empty. ACPICA allocates the element array with exactly package.count entries, so for a sub-package with a zero count this reads past the allocation. The sibling function atk_debugfs_ggrp_open() performs the same access but skips empty packages with a package.count check first. Add the same check to atk_ec_present() so a malformed firmware package cannot trigger an out-of-bounds read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80593

EUVD

EUVD-2026-67469

Affected Vendors & Products

Vendor	Product	Version / Range
asus	atk0110	*
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's hwmon subsystem, specifically in the asus_atk0110 driver. It involves an out-of-bounds read due to missing validation of ACPI package elements. The function atk_ec_present() accesses the first element of sub-packages without checking if the sub-package is empty, potentially reading past allocated memory if a malformed firmware package is encountered.

Detection Guidance

This vulnerability affects the Linux kernel's hwmon subsystem, specifically the asus_atk0110 driver. Detection requires checking if the system is running a vulnerable kernel version. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep asus_atk0110' to verify if the driver is loaded.

Impact Analysis

This vulnerability could allow a local attacker with access to the system to trigger a memory corruption issue, potentially leading to system crashes, privilege escalation, or other unintended behavior. It may also enable denial-of-service conditions if exploited.

Compliance Impact

This vulnerability is a low-level hardware monitoring driver issue in the Linux kernel that could allow out-of-bounds memory access due to improper validation of ACPI package elements. It does not directly impact data privacy or security controls required by GDPR or HIPAA. Compliance with these standards would depend on system-level mitigations and operational controls rather than this specific vulnerability.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If an update is not immediately available, consider disabling the asus_atk0110 module temporarily using 'modprobe -r asus_atk0110' until a patch is applied.

Hi! I’m here to help you understand CVE-2026-80593. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70