CVE-2026-89436

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]

acpi_pcc_retrieve_biosdata() rejects SINF packages only when

pcc->num_sifr is strictly less than hkey->package.count, then

unconditionally writes a trailing sentinel at

pcc->sinf[hkey->package.count]. But pcc->sinf[] is allocated with

exactly pcc->num_sifr elements (valid indices 0..num_sifr-1), so that

write needs num_sifr strictly greater than package.count to stay in

bounds -- num_sifr == package.count passes the existing check but

still overflows by one element.

This is exactly the case probe()'s existing num_sifr++ workaround

("Some DSDT-s have an off-by-one bug where the SINF package count is

one higher than the SQTY reported value") is written to accommodate:

when a DSDT's SINF package count equals SQTY+1, the workaround makes

num_sifr equal to package.count, which is precisely the boundary that

overflows here. Found via UBSan (array-index-ou

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References