CVE-2026-89436

Received Received - Intake

Buffer Overflow in Panasonic Laptop Kernel Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] acpi_pcc_retrieve_biosdata() rejects SINF packages only when pcc->num_sifr is strictly less than hkey->package.count, then unconditionally writes a trailing sentinel at pcc->sinf[hkey->package.count]. But pcc->sinf[] is allocated with exactly pcc->num_sifr elements (valid indices 0..num_sifr-1), so that write needs num_sifr strictly greater than package.count to stay in bounds -- num_sifr == package.count passes the existing check but still overflows by one element. This is exactly the case probe()'s existing num_sifr++ workaround ("Some DSDT-s have an off-by-one bug where the SINF package count is one higher than the SQTY reported value") is written to accommodate: when a DSDT's SINF package count equals SQTY+1, the workaround makes num_sifr equal to package.count, which is precisely the boundary that overflows here. Found via UBSan (array-index-out-of-bounds) on hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38 elements: num_sifr becomes 38 after the += 1 workaround, the loop correctly fills indices 0..37, and the sentinel write then targets index 38, one past the end -- a silent 4-byte heap overflow on kernels without CONFIG_UBSAN. Tightening the rejection check to num_sifr <= package.count would avoid the overflow but breaks probe() entirely on exactly this hardware, since num_sifr == package.count is the case the off-by-one workaround exists to support. Nothing else in the driver reads this sentinel value back, so simply skip the write when there is no room for it instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89436

EUVD

EUVD-2026-76342

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a heap-based buffer overflow in the Linux kernel's Panasonic laptop driver. The issue occurs when the driver writes a sentinel value beyond the allocated array bounds in the acpi_pcc_retrieve_biosdata function. The overflow happens when the number of SINF package elements equals the allocated buffer size, causing a one-element out-of-bounds write.

Detection Guidance

This vulnerability is specific to the Linux kernel's panasonic-laptop driver and involves an array-index-out-of-bounds issue. Detection requires checking the kernel version and driver code for the affected function. Use commands like 'uname -a' to check kernel version and 'modinfo panasonic' to inspect the driver. If your kernel version matches the affected code path, further code review or UBSan logs may reveal the issue.

Impact Analysis

This vulnerability could allow local attackers to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or arbitrary code execution. On systems without UBSAN, the overflow would be silent and undetected.

Mitigation Strategies

Apply the kernel patch that fixes the sentinel write overflow in the panasonic-laptop driver. Update to a kernel version that includes the fix. If immediate patching is not possible, consider disabling the panasonic-laptop module if not required. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-89436. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70