[CVE-2026-97455][MODERATE REGULAR] ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() [ Upstream

[AL-KERNEL <alkernel@kernelcve.org>]

CVE: CVE-2026-97455
Priority: MODERATE REGULAR
AL-KERNEL base severity: MODERATE
KPANIC flag: NO
Patch: ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() [ Upstream
Commit: fe7b3d3b7490c2c0119f2d84fa33996dcbc71042
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fe7b3d3b7490c2c0119f2d84fa33996dcbc71042
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97455
Analysis date: Thu, 24 Sep 2026 20:48:01 -0400
ActionableScore: 4
ActionableScore lower bound: unknown
Actionable bucket: Borderline / manual review recommended
Manual review required: YES

Summary:
A returned ACPICA RefOf object can retain a reference to method-local or argument storage after the control-method walk state is destroyed, creating a kernel use-after-free condition whose practical reachability and post-free use require further review.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-97455 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97455

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: MODERATE REGULAR
Manual review required: YES

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-97455	MODERATE	https://www.kernelcve.org/list/?q=CVE-2026-97455 CHECK WITH IMPACT FROM ORIG NN MODERATE	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H';*CWE-416;*CWE-664;*CWE-672;Other CVSS 'AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '6.4';DESCR 'A use after free can occur in the ACPICA control method termination path when a returned RefOf object references a method local or argument that is destroyed together with the walk state. A later use of the returned dangling reference may access freed kernel memory and can at least cause a kernel crash. For the CVSS the PR:H is used because reliable triggering normally requires control over AML supplied by ACPI firmware or the ability to install or override ACPI tables, which is generally administrative. The issue is not directly network reachable. The base impact is local denial of service. The paranoid assessment allows confidentiality and integrity impact because the flaw is a kernel use after free, but exploitation beyond denial of service is not demonstrated by the patch and requires manual review.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Borderline / manual review recommended (with actual score 4)	YES	DANGER UAF  DECREASED_TO_MODERATEREG_BASED_ON_FALSEPOSCHECKOFKP	NO	NO	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=4
PrimitiveClass=CLASS_B
RealUAF=YES
HostAdminRequired=UNKNOWN
NamespaceScopedPrivilege=UNKNOWN
ImportantCandidate=NO
ManualReview=RECOMMENDED
AutoDowngradeAllowed=YES

## 1. ActionableScore

* Raw conservative score: 2
* Conservative score: 4
* Raw paranoid score: 2
* Paranoid score: 4
* Final recommended bucket: **Borderline / manual review recommended**::

The raw score contains the directly established lifetime primitive only. The Real UAF FLOOR 4 is applied because a returned ACPI reference can outlive destruction of the associated `walk_state`, and host-admin-equivalent privilege is not positively established by the supplied patch. No paranoid uplift is justified because controlled reclaim, a second lifetime mutation, attacker-controlled replacement, disclosure, arbitrary write, or privilege escalation are not established.

## 2. Signal breakdown

Positive signals:

* +2 Real UAF or active lifetime violation. The patch explicitly identifies that `walk_state->return_desc` may contain an `ACPI_REFCLASS_REFOF` reference to a method local or argument. These local and argument slots are deleted when the `walk_state` is destroyed, while the returned reference can otherwise survive and become dangling.

Floor application:

* Real UAF FLOOR 4 applied. Raw score 2 is raised to 4 because the patch directly prevents a post-lifetime reference from surviving method teardown. This is not clearly a fixed async DMA buffer or a guaranteed immediate poison-pointer fault.

Non-awarded or withheld signals:

* +0 Reliable kernel crash or strong DoS. A stale reference can plausibly cause a kernel fault, but the supplied patch and context do not demonstrate an observed panic, reliable crash, or a specific later dereference site.
* +0 Controlled reclaim or controlled object replacement. No evidence shows that an attacker can reclaim the former `walk_state` storage with attacker-shaped contents.
* +0 Strong exploitation leverage. No attacker-controlled callback, function pointer, offset, length, refcount takeover, directed write, or active structured-object reuse is established.
* +0 Structured stale-object exploitation leverage. The stale reference targets method-local or argument storage during ACPICA control-method termination. The visible patch does not show a meaningful later consumption of attacker-controlled fields after reuse.
* +0 Concrete repeated release or refcount mutation. The patch removes one returned reference before locals and arguments are deleted. It does not establish a first release followed by a second `put`, `free`, or refcount mutation through the exact same dangling reference.
* +0 Confidentiality impact. No read-back or disclosure path is shown.
* +0 Integrity impact. No unauthorized modification or write primitive is shown.
* +0 Local unprivileged trigger. The supplied material does not establish that an ordinary local user can provide or invoke attacker-controlled AML that reaches this condition.
* +0 Remote reachability. ACPI AML is firmware-mediated input. The patch provides no direct network path.
* No privilege penalty applied. The prior PR:H interpretation is plausible for custom ACPI-table installation or firmware override, but it is not positively established as a complete prerequisite by the supplied call path. Under the stated rules, this remains unknown rather than receiving a host-admin penalty.
* No hard-race penalty applied. This is an ordered lifetime problem during control-method teardown, not a demonstrated timing race.
* No niche-subsystem penalty applied. ACPICA is broadly present on ACPI-capable systems, and subsystem reputation alone is not a valid negative signal.

## 3. Reachability analysis

The vulnerable condition requires an ACPI control method to return a `RefOf` reference that points to one of its own method-local or argument slots. The method then terminates and destroys the `walk_state`, leaving the returned object with a reference to storage whose lifetime has ended.

The relevant attacker model is unresolved. Supplying malicious AML normally implies control of firmware-provided ACPI tables, a table override mechanism, or another platform-specific ACPI-table loading path. Such operations often require firmware compromise or administrative control, but the supplied patch does not show the complete table-loading path, any relevant capability checks, or whether a pre-existing firmware method can be invoked through an interface reachable by a less-privileged local user.

Therefore:

* Host-admin-equivalent privilege is not positively established. `HostAdminRequired=UNKNOWN`.
* Below-host-admin reachability is also not positively established. This prevents assigning `HostAdminRequired=NO`.
* No namespace-based trigger is described. `NamespaceScopedPrivilege=UNKNOWN`.
* No network trigger is established. Firmware-mediated AML input is not direct remote reachability.
* No special hardware requirement beyond a system using ACPICA/ACPI is proven. However, practical exploitation may depend on platform firmware behavior and AML method reachability.
* No race or repeatable attacker-controlled free/reuse sequence is visible in the supplied patch.

## 4. Primitive and severity interpretation

The exact primitive is a real lifetime violation: a returned `ACPI_TYPE_LOCAL_REFERENCE` with `ACPI_REFCLASS_REFOF` can reference a method-local or method-argument slot stored in `struct acpi_walk_state`. When `acpi_ds_terminate_control_method()` deletes that walk state, the referenced storage loses its valid lifetime. The returned reference can therefore become stale and may later be used.

This is an active structured lifetime issue rather than fixed stale DMA or device storage. However, the visible fix is in a control-method teardown path, and the supplied context does not show the later stale-use operation, attacker-controlled replacement contents, callback dispatch, pointer traversal through reclaimed data, repeated refcount mutation, or an arbitrary read/write primitive.

This is therefore `CLASS_B`, not `CLASS_A`:

* It is not `CLASS_C` because the patch explicitly prevents a returned dangling reference from surviving object lifetime.
* It is not `CLASS_A` because no controlled reclaim, object substitution, arbitrary write, security-boundary bypass, disclosure, or demonstrated privilege escalation is established.

The demonstrated security-relevant consequence is a potential stale post-lifetime reference in kernel ACPICA state. A kernel crash is plausible if the stale reference is later dereferenced, but it is not directly demonstrated in the supplied material. Privilege escalation, confidentiality impact, and integrity impact remain speculative and are not scored.

`ImportantCandidate=NO` is appropriate because this is a teardown-oriented UAF without evidence of meaningful reuse or post-free structured consumption. `AutoDowngradeAllowed=YES` is appropriate under this scoring model because the visible evidence supports a constrained Class B lifetime defect, not unresolved controlled corruption. Manual review remains recommended to inspect the callers that consume `return_desc` after control-method termination and to determine whether platform-specific AML reachability lowers the actual privilege requirement.

Likely operational severity is Borderline or ordinary Actionable Moderate depending on the downstream use site and whether untrusted or user-triggerable AML execution is possible in the evaluated product.

## 5. One-sentence report phrase

A returned ACPICA RefOf object can retain a reference to method-local or argument storage after the control-method walk state is destroyed, creating a kernel use-after-free condition whose practical reachability and post-free use require further review.

## 6. Manual review recommendation

MANUAL CHECK RECOMMENDED

The patch directly establishes a real UAF, but the supplied context does not show the later stale-use caller, the actual crash behavior, attacker control over AML input, or a controlled reuse primitive.

## 7. Call-site confidence

Call-site confidence: medium

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() [ Upstream
Commit: fe7b3d3b7490c2c0119f2d84fa33996dcbc71042
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fe7b3d3b7490c2c0119f2d84fa33996dcbc71042

Changed files:
  drivers/acpi/acpica/dsmethod.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fe7b3d3b7490c2c0119f2d84fa33996dcbc71042

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-97455 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97455

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
  The Best / paranoid CVSS vector: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
  The Best / paranoid CVSS score: 6.4

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: unknown
  Paranoid ActionableScore: 4

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: NO
Published priority for this report (same as in Subject): MODERATE REGULAR

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).