CVE-2026-31426

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()

When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware

platforms, it has already started the EC and installed the address

space handler with the struct acpi_ec pointer as handler context.

However, acpi_ec_setup() propagates the error without any cleanup.

The caller acpi_ec_add() then frees the struct acpi_ec for non-boot

instances, leaving a dangling handler context in ACPICA.

Any subsequent AML evaluation that accesses an EC OpRegion field

dispatches into acpi_ec_space_handler() with the freed pointer,

causing a use-after-free:

BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289)

Write of size 8 at addr ffff88800721de38 by task init/1

Call Trace:

<TASK>

mutex_lock (kernel/locking/mutex.c:289)

acpi_ec_space_handler (drivers/acpi/ec.c:1362)

acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References