---
id: CVE-2026-92522
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ACPI: processor: validate MADT IOAPIC entry bounds

  The IOAPIC hotplug lookup parses both MADT and _MAT records directly.
  The MADT walk previously used a subtable's dec…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ACPI: processor: validate MADT IOAPIC entry bounds

  The IOAPIC hotplug lookup parses both MADT and _MAT records directly.
  The MADT walk previously used a subtable's dec…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    5601bd81bc290a724ed47797d22c16cba4d7ed9f
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    ff82e3374e9103d046b2a82f4315d9a422ff097d
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    2a5520065e76000f8c979d3d7b3d861ccaaecf1e
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    8e67b58c04990817ac2dbf8ae03353be6a358cd4
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    74d84320f8e37955eb286a7777843d554e6e75b2
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    4d8ecaa332c163f2b44aa5027bf061950b71b5f3
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    355bee5f11acb116cd256588631b4028ca562646
  - >-
    Linux >= ecf5636dcd59cd5508641f995cc4c2bafedbb995 <
    2c50ffdc73f3a70d745d249f509fc290754121e6
  - Linux 4.0
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:18:14.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92522'
references:
  - url: 'https://git.kernel.org/stable/c/2a5520065e76000f8c979d3d7b3d861ccaaecf1e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2c50ffdc73f3a70d745d249f509fc290754121e6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/355bee5f11acb116cd256588631b4028ca562646'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d8ecaa332c163f2b44aa5027bf061950b71b5f3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5601bd81bc290a724ed47797d22c16cba4d7ed9f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/74d84320f8e37955eb286a7777843d554e6e75b2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8e67b58c04990817ac2dbf8ae03353be6a358cd4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ff82e3374e9103d046b2a82f4315d9a422ff097d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00184
epssPercentile: 0.07071
ingestedAt: '2026-09-17T16:21:47.776Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ACPI: processor: validate MADT IOAPIC entry bounds

The IOAPIC hotplug lookup parses both MADT and _MAT records directly.
The MADT walk previously used a subtable's declared length to advance
the cursor after only locating a generic header.  The _MAT path likewise
passed a generic header to the IOAPIC helper.

Validate that a current record has a complete generic header, that its
declared length is contained in the available record range, and that a
typed IOAPIC record contains the full fixed IOAPIC body before reading
its fields.  Use the same relation for both MADT and _MAT provider
paths.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.