CVE-2026-64512

ACPI: CPPC: Suppress UBSAN warning caused by field misuse

N/A
Published: July 25, 2026 at 08:52 AM UTC
Updated: August 17, 2026 at 05:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppress UBSAN warning caused by field misuse The definition of reg->access_width changes depending on the reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses access_width to indicate the PCC region, which can result in a UBSAN if the value is greater than 4. For example: UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9 shift exponent 32 is too large for 32-bit type 'int' CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy) Hardware name: To be filled by O.E.M. Call trace: ...(trimming) ubsan_epilogue+0x10/0x48 __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0 cpc_write+0x4d0/0x670 cppc_set_perf+0x18c/0x490 cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq] ... (trimming) Lets fix this by validating the region type, as well as whether access_width has a value. Then since we are returning bit_width directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting the size.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≥ 6.8.95.15.154 ≤ v < 5.15.1556.1.90 ≤ v < 6.1.1786.6.30 ≤ v < 6.6.1456.8.9 ≤ v < 6.96.9 ≤ v < 6.12.966.9 ≤ v < 6.18.396.9 ≤ v < 7.1.46.9 ≤ v < 7.21b890ae474d19800a6be1696df7fb4d9a41676e41fc53be672acae37e611c80cc0b4f3939584de32f4a4d63a193be6fd530d180bb13c3592052904c4949affd5288b867cdf115f5b08d6166b2027f875.15.1546.1.906.6.306.8.96.96cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1
Vendor states this is fixed in 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 (fixed)
Vendor states this is fixed in 2fb80e962029000959f651665baa4838cc92eb99 (fixed)
Vendor states this is fixed in 37f28bf8f14672dfa395994e41fd778a63f0bf5c (fixed)
Vendor states this is fixed in b54c4632946ae42f2b39ed38abd909bbf78cbcc2 (fixed)
Vendor states this is fixed in dc066bd13c860bb27d6ace511210e18b8064c1d9 (fixed)
Vendor states this is fixed in e904596ba6dd108534ffa15e3e46b2fe245145e2 (fixed)
Vendor states this is fixed in f29dc6132d4968e39d8fa575d1a12e2c718ce57b (fixed)
Vendor states this is fixed in 5.15.155 (unaffected)
Vendor states this is fixed in 6.1.178 (unaffected)
Vendor states this is fixed in 6.12.96 (unaffected)
Vendor states this is fixed in 6.18.39 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 6.9 (unaffected)
Vendor states this is fixed in 7.1.4 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card