Bug 2525425 (CVE-2026-80593)

Summary: CVE-2026-80593 kernel: hwmon: (asus_atk0110) Check package count before accessing element
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel, specifically within the hwmon (hardware monitoring) subsystem's asus_atk0110 driver. This vulnerability occurs because the `atk_ec_present()` function does not properly check the size of a data package before attempting to read its contents. A local attacker could exploit this by providing a specially crafted firmware package, which could lead to an out-of-bounds read. This could result in information disclosure or potentially cause system instability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-28 07:44:20 UTC 
In the Linux kernel, the following vulnerability has been resolved:

hwmon: (asus_atk0110) Check package count before accessing element

atk_ec_present() walks the management group package returned by the GGRP
ACPI method and, for each sub-package, reads its first element:

	id = &obj->package.elements[0];
	if (id->type != ACPI_TYPE_INTEGER)

without checking that the sub-package is non-empty.  ACPICA allocates the
element array with exactly package.count entries, so for a sub-package
with a zero count this reads past the allocation.

The sibling function atk_debugfs_ggrp_open() performs the same access but
skips empty packages with a package.count check first.  Add the same
check to atk_ec_present() so a malformed firmware package cannot trigger
an out-of-bounds read.
Comment 1 gkamathe 2026-08-31 13:05:57 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082830-CVE-2026-80593-5662@gregkh/T