CVE-2026-89436 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators of systems using the panasonic-laptop platform, and security teams responsible for vulnerability management should prioritize updates and verify SINF package counts and SQTY reported values to identify potential off-by-one issues. This vulnerability highlights the need for thorough validation of these values to prevent potential exposure.

Why it matters

CVE-2026-89436 is a Linux kernel vulnerability that allows for a silent 4-byte heap overflow due to a sentinel write past the end of the pcc->sinf array. Defenders should assess and prioritize Linux kernel updates, particularly for systems using the panasonic-laptop platform. Verification of SINF package count and SQTY reported values is required to identify potential off-by-one issues.

• Silent 4-byte heap overflow possible due to out-of-bounds write
• Verification of SINF package count and SQTY reported values required
• Potential for system crashes or instability if exploited
• Prioritization of Linux kernel updates for affected systems

Technical summary

The acpi_pcc_retrieve_biosdata function in the Linux kernel does not properly check the bounds of pcc->sinf when writing a sentinel value, leading to a potential 4-byte heap overflow. This occurs when the DSDT's SINF package count equals SQTY+1, triggering an off-by-one workaround. The issue arises from the interaction between the SINF package count and the SQTY reported value, which can lead to an out-of-bounds write if not properly validated. Defenders should focus on verifying these values to assess potential exposure.

Defensive priority

Assess and prioritize Linux kernel updates, particularly for systems using the panasonic-laptop platform. Verify the SINF package count and SQTY reported values to identify potential off-by-one issues.

Recommended defensive actions

• Assess Linux kernel versions and configurations for exposure
• Prioritize updates for systems using the panasonic-laptop platform
• Verify SINF package count and SQTY reported values
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue was found via UBSan (array-index-out-of-bounds) on hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38 elements. The vulnerability is resolved in later kernel versions. This highlights the need for thorough verification of SINF package counts and SQTY reported values to identify potential off-by-one issues. Defenders should focus on validating these values to assess potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.